2ae7255eedd7f4d39a999f57209497235d632e543356e34f634ce90522d2b2b2

privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1119	chmod

Modifies sudoers policy 1 IoCs

Adds/ Modifies rule files for sudoers policy, likely to grant additional privileges.

description	ioc	Process
File opened for modification	/etc/sudoers	install_cloud.sh

OS Credential Dumping 1 TTPs 3 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	usermod
File opened for reading	/etc/shadow	dpkg-preconfigure

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 4 IoCs

Abuse sudo or cached sudo credentials to execute code.

Sudo and Sudo Caching

T1548.003

pid	Process
768	sudo
1066	sudo
1075	sudo
1315	sudo

Adds a user to the system 1 IoCs

pid	Process
751	useradd

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

description	ioc	Process
File opened for modification	/home/px_user/.bashrc	useradd
File opened for modification	/home/px_user/.profile	useradd

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/apt/eipp.log.xz	apt-get

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/newuidmap.dpkg-new	dpkg
File opened for modification	/usr/bin/newgidmap.dpkg-new	dpkg

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/home/px_user/.bashrc	useradd
File opened for modification	/home/px_user/.profile	useradd

Reads CPU attributes 1 TTPs 8 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	loginctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/1/environ	loginctl
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	apt-get
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/kernel/ngroups_max	sendmail
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	sendmail
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
1049	dpkg-split
1049	dpkg-split
1598	chmod
1607	gpgv
1610	rm
729	ip
1049	dpkg-split
1049	dpkg-split

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.503WJY	apt-get
File opened for modification	/tmp/apt-key-gpghome.WzImj4ihf8/gpg.0.sh	apt-key
File opened for modification	/tmp/fileutl.message.nExl7u	apt
File opened for modification	/tmp/apt.sig.KdMtQb	gpgv
File opened for modification	/tmp/fileutl.message.Vu6l9h	apt-get
File opened for modification	/tmp/apt-key-gpghome.omXWoo5m6i/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.7WZQFT	apt
File opened for modification	/tmp/fileutl.message.KUJAlW	apt
File opened for modification	/tmp/apt.sig.UGTPO9	gpgv
File opened for modification	/tmp/fileutl.message.yL98yh	apt-get
File opened for modification	/tmp/apt-key-gpghome.WzImj4ihf8/.#lk0x5642cd18.debian9-mipsel-20240729-en-2.1356	gpg
File opened for modification	/tmp/apt-key-gpghome.HuRWpurJ1a/pubring.orig.gpg	cp
File opened for modification	/tmp/apt-key-gpghome.vZBndZ5LhJ/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.fVF0mnxOLp/pubring.gpg	touch
File opened for modification	/tmp/fileutl.message.fOiWQn	apt
File opened for modification	/tmp/apt.data.4XGIiE	gpgv
File opened for modification	/tmp/apt-key-gpghome.gamUzYaJnp/pubring.gpg	apt-key
File opened for modification	/tmp/apt.data.LDnv5K	gpgv
File opened for modification	/tmp/apt-key-gpghome.WzImj4ihf8/.#lk0x55bd2d18.debian9-mipsel-20240729-en-2.1353	gpg
File opened for modification	/tmp/fileutl.message.HwQug0	apt
File opened for modification	/tmp/apt.conf.y0KviQ	gpgv
File opened for modification	/tmp/apt-key-gpghome.Vdjn4OGA6X/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.EIa3ZN	apt
File opened for modification	/tmp/apt.conf.abF7mh	gpgv
File opened for modification	/tmp/fileutl.message.joN2PJ	apt
File opened for modification	/tmp/fileutl.message.10hFxy	apt-get
File opened for modification	/tmp/fileutl.message.LMuT8C	apt-get
File opened for modification	/tmp/fileutl.message.NN2qwz	apt-get
File opened for modification	/tmp/fileutl.message.YZHY0j	apt-get
File opened for modification	/tmp/apt.conf.5S1BQ6	gpgv
File opened for modification	/tmp/apt-key-gpghome.fVF0mnxOLp/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.0IDNo0	apt
File opened for modification	/tmp/fileutl.message.Cpm7mf	apt-cache
File opened for modification	/tmp/fileutl.message.LYieDP	apt-cache
File opened for modification	/tmp/fileutl.message.UHPs3S	apt-get
File opened for modification	/tmp/apt.data.eyIURH	gpgv
File opened for modification	/tmp/apt-key-gpghome.WzImj4ihf8/pubring.kbx	gpg
File opened for modification	/tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.0dJapm	apt
File opened for modification	/tmp/fileutl.message.BOHQjy	apt
File opened for modification	/tmp/apt.conf.RIwqVa	gpgv
File opened for modification	/tmp/fileutl.message.AYPOdc	apt
File opened for modification	/tmp/apt-key-gpghome.WzImj4ihf8/.#lk0x564763a8.debian9-mipsel-20240729-en-2.1392	gpg
File opened for modification	/tmp/fileutl.message.QKB1EY	apt
File opened for modification	/tmp/apt-key-gpghome.MEsSiO3JfC/pubring.orig.gpg	cp
File opened for modification	/tmp/apt.sig.oXxWaR	gpgv
File opened for modification	/tmp/apt-key-gpghome.WzImj4ihf8/trustdb.gpg	gpg
File opened for modification	/tmp/apt-key-gpghome.gamUzYaJnp/pubring.gpg	touch
File opened for modification	/tmp/apt.data.z35nLc	gpgv
File opened for modification	/tmp/fileutl.message.0OqPpt	apt-cache
File opened for modification	/tmp/apt-key-gpghome.lAvJA6xOp5/pubring.gpg	touch
File opened for modification	/tmp/apt.conf.sDVgt0	gpgv
File opened for modification	/tmp/apt-key-gpghome.WzImj4ihf8/empty.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.omXWoo5m6i/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.MEsSiO3JfC/pubring.gpg	touch
File opened for modification	/tmp/apt.sig.ChZjOi	gpgv
File opened for modification	/tmp/apt-key-gpghome.9UNyZ777aw/pubring.gpg	touch
File opened for modification	/tmp/apt.sig.yWk7Zc	gpgv
File opened for modification	/tmp/apt-key-gpghome.HuRWpurJ1a/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.lAvJA6xOp5/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.s62YNG	apt
File opened for modification	/tmp/apt-key-gpghome.HuRWpurJ1a/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.WzImj4ihf8/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.a4AuYa	apt

Software Deployment Tools 1 TTPs 4 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1082	apt-get
1027	apt-get
1049	dpkg-split
1058	dpkg

/tmp/install_cloud.sh
/tmp/install_cloud.sh
1⤵
- Modifies sudoers policy
PID:712
- /usr/bin/tee
  tee -a /var/log/px-install.log
  2⤵
  PID:716
- /bin/date
  date
  2⤵
  PID:717
- /bin/sed
  sed "s/x86_64/amd64/;s/aarch64/arm64/"
  2⤵
  PID:722
- /bin/uname
  uname -m
  2⤵
  PID:721
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:731
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:730
- /sbin/ip
  ip route get 1.2.3.4
  2⤵
  - System Network Configuration Discovery
  PID:729
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:736
- /usr/bin/awk
  awk "{print \$3}"
  2⤵
  PID:742
- /usr/bin/id
  id -u
  2⤵
  PID:745
- /usr/bin/id
  id px_user
  2⤵
  PID:750
- /usr/sbin/useradd
  useradd -m -s /bin/bash px_user
  2⤵
  - Modifies password files for system users/ groups
  - OS Credential Dumping
  - Adds a user to the system
  - Creates/modifies environment variables
  - Modifies Bash startup script
  - Reads runtime system information
  PID:751
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:754
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:755
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:756
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:757
- /usr/bin/id
  id -nG px_user
  2⤵
  PID:758
- /bin/grep
  grep -qw systemd-journal
  2⤵
  PID:759
- /usr/sbin/usermod
  usermod -aG systemd-journal px_user
  2⤵
  - Modifies password files for system users/ groups
  - OS Credential Dumping
  PID:760
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:764
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:765
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:766
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:767
- /usr/bin/sudo
  sudo loginctl enable-linger px_user
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:768
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:785
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty7z3-0000Cf-Ks
      4⤵
      Reads CPU attributes
      PID:799
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:788
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty7z3-0000Ci-LF
      4⤵
      Reads CPU attributes
      PID:798
- - /bin/loginctl
    loginctl enable-linger px_user
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:790
- /usr/bin/apt
  apt -y update
  2⤵
  - Writes file to tmp directory
  PID:795
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:801
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:807
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:809
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:812
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:815
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    PID:836
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    - Writes file to tmp directory
    PID:837
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.yWk7Zc /tmp/apt.data.2FrB3K
      4⤵
      PID:840
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        
        PID:842
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:843
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:844
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:845
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:846
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:847
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:848
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:849
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:851
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:852
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:853
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.8OiqaoRgAy
        5⤵
        
        PID:854
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:858
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:861
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.8OiqaoRgAy --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.yWk7Zc /tmp/apt.data.2FrB3K
        5⤵
        Reads runtime system information
        
        PID:863
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:864
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:865
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.8OiqaoRgAy
        5⤵
        
        PID:866
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.UGTPO9 /tmp/apt.data.z35nLc
      4⤵
      Writes file to tmp directory
      PID:868
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        
        PID:870
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:871
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:872
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:874
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:875
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:876
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:877
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:878
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        
        PID:879
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:880
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:881
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:884
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:887
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:889
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:891
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.fVF0mnxOLp
        5⤵
        
        PID:892
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.fVF0mnxOLp
        5⤵
        
        PID:893
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.fVF0mnxOLp/pubring.gpg
        5⤵
        
        PID:895
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.fVF0mnxOLp/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:896
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:897
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:900
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:901
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:902
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:906
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:909
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:911
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:913
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:916
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:918
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:921
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:923
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:925
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:927
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.fVF0mnxOLp/pubring.gpg /tmp/apt-key-gpghome.fVF0mnxOLp/pubring.orig.gpg
        5⤵
        
        PID:928
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:932
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:936
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.fVF0mnxOLp --keyring /tmp/apt-key-gpghome.fVF0mnxOLp/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.UGTPO9 /tmp/apt.data.z35nLc
        5⤵
        Reads runtime system information
        
        PID:937
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        
        PID:940
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:941
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.fVF0mnxOLp
        5⤵
        
        PID:943
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
      4⤵
      Writes file to tmp directory
      PID:946
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        
        PID:948
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:950
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:952
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:957
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:959
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:961
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:963
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:965
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        
        PID:967
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:969
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:971
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:973
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:976
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:977
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:978
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.HuRWpurJ1a
        5⤵
        
        PID:979
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.HuRWpurJ1a
        5⤵
        
        PID:980
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.HuRWpurJ1a/pubring.gpg
        5⤵
        
        PID:981
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.HuRWpurJ1a/pubring.gpg
        5⤵
        
        PID:982
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:983
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:984
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:985
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:986
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:989
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:991
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:993
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:995
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:997
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:999
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:1001
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:1003
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:1005
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:1007
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.HuRWpurJ1a/pubring.gpg /tmp/apt-key-gpghome.HuRWpurJ1a/pubring.orig.gpg
        5⤵
        Writes file to tmp directory
        
        PID:1008
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:1011
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:1014
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.HuRWpurJ1a --keyring /tmp/apt-key-gpghome.HuRWpurJ1a/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        
        PID:1015
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        
        PID:1016
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        
        PID:1017
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.HuRWpurJ1a
        5⤵
        
        PID:1018
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1019
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1020
- /usr/bin/apt
  apt install -y curl
  2⤵
  - Writes file to tmp directory
  PID:1021
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1022
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1023
- /usr/bin/apt
  apt install -y fuse-overlayfs
  2⤵
  - Writes file to tmp directory
  PID:1024
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1025
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1026
- /usr/bin/apt-get
  apt-get install -y uidmap
  2⤵
  - Deletes log files
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:1027
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1028
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1029
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1030
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1031
- - /bin/sh
    /bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
    3⤵
    PID:1032
  - - /usr/sbin/dpkg-preconfigure
      /usr/sbin/dpkg-preconfigure --apt
      4⤵
      OS Credential Dumping
      PID:1033
    - - /usr/local/sbin/locale
        
        locale charmap
        5⤵
        
        PID:1034
    - - /usr/local/bin/locale
        
        locale charmap
        5⤵
        
        PID:1034
    - - /usr/sbin/locale
        
        locale charmap
        5⤵
        
        PID:1034
    - - /usr/bin/locale
        
        locale charmap
        5⤵
        
        PID:1034
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1035
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1036
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1037
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1038
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1039
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1040
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1041
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1042
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1043
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1044
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1045
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1046
- - /usr/bin/dpkg
    /usr/bin/dpkg --assert-multi-arch
    3⤵
    PID:1047
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 14 --no-triggers --unpack --auto-deconfigure "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb"
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1048
  - - /usr/local/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb"
      4⤵
      System Network Configuration Discovery
      PID:1049
  - - /usr/local/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb"
      4⤵
      System Network Configuration Discovery
      PID:1049
  - - /usr/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb"
      4⤵
      System Network Configuration Discovery
      PID:1049
  - - /usr/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb"
      4⤵
      System Network Configuration Discovery
      Software Deployment Tools
      PID:1049
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --control "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb" /var/lib/dpkg/tmp.ci
      4⤵
      PID:1050
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --control "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb" /var/lib/dpkg/tmp.ci
      4⤵
      PID:1050
  - - /usr/sbin/dpkg-deb
      dpkg-deb --control "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb" /var/lib/dpkg/tmp.ci
      4⤵
      PID:1050
  - - /usr/bin/dpkg-deb
      dpkg-deb --control "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb" /var/lib/dpkg/tmp.ci
      4⤵
      PID:1050
    - - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1053
    - - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1053
    - - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1053
    - - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1053
    - - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1053
    - - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1053
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb"
      4⤵
      PID:1054
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --fsys-tarfile "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb"
      4⤵
      PID:1054
  - - /usr/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb"
      4⤵
      PID:1054
  - - /usr/bin/dpkg-deb
      dpkg-deb --fsys-tarfile "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mipsel.deb"
      4⤵
      PID:1054
  - - /usr/local/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1057
  - - /usr/local/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1057
  - - /usr/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1057
  - - /usr/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1057
  - - /sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1057
  - - /bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1057
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 14 --configure --pending
    3⤵
    - Software Deployment Tools
    PID:1058
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1059
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1060
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1061
- /usr/bin/apt-cache
  apt-cache search podman
  2⤵
  - Writes file to tmp directory
  PID:1062
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1064
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1065
- /bin/grep
  grep podman
  2⤵
  PID:1063
- /usr/bin/sudo
  sudo sh -c "echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1066
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    - Reads runtime system information
    PID:1069
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty80H-0000HF-Fj
      4⤵
      Reads CPU attributes
      PID:1084
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:1072
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty80H-0000HI-Fk
      4⤵
      Reads CPU attributes
      PID:1083
- - /bin/sh
    sh -c "echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list"
    3⤵
    PID:1073
- /usr/bin/sudo
  sudo apt-get update
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1075
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    - Reads runtime system information
    PID:1078
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty80I-0000HO-80
      4⤵
      Reads CPU attributes
      PID:1086
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:1081
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty80I-0000HR-8I
      4⤵
      Reads CPU attributes
      PID:1087
- - /usr/bin/apt-get
    apt-get update
    3⤵
    - Writes file to tmp directory
    - Software Deployment Tools
    PID:1082
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1085
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1090
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:1093
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:1094
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1095
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1096
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      PID:1098
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      Writes file to tmp directory
      PID:1099
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.ChZjOi /tmp/apt.data.Prx3Lm
        5⤵
        
        PID:1101
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        Reads runtime system information
        
        PID:1103
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1104
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:1105
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1106
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:1107
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1108
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        
        PID:1109
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1110
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:1111
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1112
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        
        PID:1113
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1114
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        
        PID:1116
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1117
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:1118
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.9UNyZ777aw
        6⤵
        File and Directory Permissions Modification
        
        PID:1119
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.9UNyZ777aw
        6⤵
        
        PID:1120
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.9UNyZ777aw/pubring.gpg
        6⤵
        
        PID:1121
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.9UNyZ777aw/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:1122
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        
        PID:1123
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1124
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:1125
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        
        PID:1126
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:1129
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:1131
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:1133
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:1135
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:1137
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:1139
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:1141
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:1143
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:1145
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:1147
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.9UNyZ777aw/pubring.gpg /tmp/apt-key-gpghome.9UNyZ777aw/pubring.orig.gpg
        6⤵
        
        PID:1148
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1151
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1154
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.9UNyZ777aw --keyring /tmp/apt-key-gpghome.9UNyZ777aw/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.ChZjOi /tmp/apt.data.Prx3Lm
        6⤵
        
        PID:1155
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        
        PID:1156
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        
        PID:1157
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.9UNyZ777aw
        6⤵
        
        PID:1158
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.KdMtQb /tmp/apt.data.lHVNKc
        5⤵
        Writes file to tmp directory
        
        PID:1160
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:1162
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1163
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        Reads runtime system information
        
        PID:1164
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1165
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:1166
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1167
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:1168
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1169
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:1170
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1171
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        
        PID:1172
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1173
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        
        PID:1175
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1176
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:1177
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.vZBndZ5LhJ
        6⤵
        
        PID:1178
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.vZBndZ5LhJ
        6⤵
        
        PID:1179
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.vZBndZ5LhJ/pubring.gpg
        6⤵
        
        PID:1180
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.vZBndZ5LhJ/pubring.gpg
        6⤵
        
        PID:1181
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        
        PID:1182
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1183
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:1184
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        
        PID:1185
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:1188
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:1190
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:1192
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:1194
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:1196
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:1198
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:1200
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:1202
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:1204
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:1206
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.vZBndZ5LhJ/pubring.gpg /tmp/apt-key-gpghome.vZBndZ5LhJ/pubring.orig.gpg
        6⤵
        
        PID:1207
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1210
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:1213
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.vZBndZ5LhJ --keyring /tmp/apt-key-gpghome.vZBndZ5LhJ/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.KdMtQb /tmp/apt.data.lHVNKc
        6⤵
        
        PID:1214
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Reads runtime system information
        
        PID:1215
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        
        PID:1216
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.vZBndZ5LhJ
        6⤵
        
        PID:1217
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Writes file to tmp directory
        
        PID:1219
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:1221
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1224
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:1225
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1226
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:1227
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1228
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        
        PID:1229
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1230
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        Reads runtime system information
        
        PID:1231
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1232
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        
        PID:1233
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1234
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:1236
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1237
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:1238
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.lAvJA6xOp5
        6⤵
        
        PID:1239
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.lAvJA6xOp5
        6⤵
        
        PID:1240
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.lAvJA6xOp5/pubring.gpg
        6⤵
        
        PID:1241
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.lAvJA6xOp5/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:1242
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        
        PID:1243
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1244
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:1245
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        
        PID:1246
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:1249
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:1251
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:1253
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:1255
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:1257
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:1259
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:1261
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:1263
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:1265
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:1267
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.lAvJA6xOp5/pubring.gpg /tmp/apt-key-gpghome.lAvJA6xOp5/pubring.orig.gpg
        6⤵
        Reads runtime system information
        
        PID:1268
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1271
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1274
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.lAvJA6xOp5 --keyring /tmp/apt-key-gpghome.lAvJA6xOp5/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        6⤵
        
        PID:1275
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        
        PID:1276
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        
        PID:1277
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.lAvJA6xOp5
        6⤵
        
        PID:1278
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.oXxWaR /tmp/apt.data.eyIURH
        5⤵
        Writes file to tmp directory
        
        PID:1280
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:1282
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1283
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:1284
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1285
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:1286
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1287
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        
        PID:1288
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1289
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        
        PID:1291
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1292
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:1293
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.Vdjn4OGA6X
        6⤵
        
        PID:1294
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1298
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1301
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.Vdjn4OGA6X --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.oXxWaR /tmp/apt.data.eyIURH
        6⤵
        
        PID:1303
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        
        PID:1304
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        
        PID:1305
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.Vdjn4OGA6X
        6⤵
        
        PID:1306
  - - /usr/lib/apt/methods/store
      /usr/lib/apt/methods/store
      4⤵
      PID:1222
  - - /usr/lib/apt/methods/store
      /usr/lib/apt/methods/store
      4⤵
      PID:1223
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1307
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1308
- /usr/bin/head
  head -n 1
  2⤵
  PID:1314
- /bin/grep
  grep -oP "(?<=NO_PUBKEY\\s)[A-F0-9]{16}"
  2⤵
  PID:1313
- /usr/bin/awk
  awk "{print }"
  2⤵
  PID:1311
- /usr/bin/sudo
  sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1315
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:1318
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty80d-0000LG-KR
      4⤵
      Reads CPU attributes
      PID:1328
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:1321
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty80d-0000LJ-Kj
      4⤵
      Reads CPU attributes
      PID:1329
- - /usr/bin/apt-key
    apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
    3⤵
    - Writes file to tmp directory
    PID:1322
  - - /usr/bin/apt-config
      apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
      4⤵
      PID:1325
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        
        PID:1326
  - - /usr/bin/apt-config
      apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
      4⤵
      PID:1327
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1330
  - - /usr/bin/apt-config
      apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
      4⤵
      PID:1331
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        
        PID:1332
  - - /usr/bin/apt-config
      apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
      4⤵
      PID:1333
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        
        PID:1336
  - - /usr/bin/apt-config
      apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
      4⤵
      PID:1337
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1338
  - - /usr/bin/apt-config
      apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
      4⤵
      PID:1339
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        
        PID:1340
  - - /usr/bin/apt-config
      apt-config shell GPG_EXE Apt::Key::gpgcommand
      4⤵
      PID:1342
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        
        PID:1343
  - - /bin/mktemp
      mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
      4⤵
      PID:1344
  - - /bin/chmod
      chmod 700 /tmp/apt-key-gpghome.WzImj4ihf8
      4⤵
      PID:1345
  - - /bin/sed
      sed -e "s#'#'\"'\"'#g"
      4⤵
      PID:1348
  - - /bin/sed
      sed -e "s#'#'\"'\"'#g"
      4⤵
      PID:1351
  - - /usr/bin/touch
      touch /tmp/apt-key-gpghome.WzImj4ihf8/empty.gpg
      4⤵
      Writes file to tmp directory
      PID:1352
  - - /usr/bin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.WzImj4ihf8 --quiet --check-trustdb --keyring /tmp/apt-key-gpghome.WzImj4ihf8/empty.gpg
      4⤵
      Writes file to tmp directory
      PID:1353
  - - /bin/sh
      sh /tmp/apt-key-gpghome.WzImj4ihf8/gpg.0.sh --batch --import
      4⤵
      PID:1356
  - - /usr/local/sbin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.WzImj4ihf8 --no-auto-check-trustdb --trust-model always --batch --import
      4⤵
      PID:1356
  - - /usr/local/bin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.WzImj4ihf8 --no-auto-check-trustdb --trust-model always --batch --import
      4⤵
      PID:1356
  - - /usr/sbin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.WzImj4ihf8 --no-auto-check-trustdb --trust-model always --batch --import
      4⤵
      PID:1356
  - - /usr/bin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.WzImj4ihf8 --no-auto-check-trustdb --trust-model always --batch --import
      4⤵
      Writes file to tmp directory
      PID:1356
  - - /bin/readlink
      readlink -f /tmp/apt-key-gpghome.WzImj4ihf8
      4⤵
      PID:1357
  - - /bin/rm
      rm -f /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg
      4⤵
      PID:1358
  - - /usr/bin/touch
      touch /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg
      4⤵
      PID:1359
  - - /usr/bin/apt-config
      apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
      4⤵
      Reads runtime system information
      PID:1360
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        
        PID:1361
  - - /bin/readlink
      readlink -f /etc/apt/trusted.gpg.d/
      4⤵
      PID:1362
  - - /usr/bin/find
      find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
      4⤵
      PID:1363
  - - /usr/bin/sort
      sort
      4⤵
      PID:1366
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
      4⤵
      PID:1368
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
      4⤵
      PID:1370
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
      4⤵
      PID:1372
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
      4⤵
      PID:1374
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
      4⤵
      PID:1376
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
      4⤵
      PID:1378
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
      4⤵
      PID:1380
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
      4⤵
      PID:1382
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
      4⤵
      PID:1384
  - - /bin/cp
      cp -a /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg /tmp/apt-key-gpghome.WzImj4ihf8/pubring.orig.gpg
      4⤵
      PID:1385
  - - /bin/sed
      sed -e "s#'#'\"'\"'#g"
      4⤵
      Reads runtime system information
      PID:1388
  - - /bin/sed
      sed -e "s#'#'\"'\"'#g"
      4⤵
      Reads runtime system information
      PID:1391
  - - /bin/sh
      sh /tmp/apt-key-gpghome.WzImj4ihf8/gpg.1.sh --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
      4⤵
      PID:1392
  - - /usr/local/sbin/sh
      sh /tmp/apt-key-gpghome.WzImj4ihf8/gpg.0.sh --keyring /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
      4⤵
      PID:1392
  - - /usr/local/bin/sh
      sh /tmp/apt-key-gpghome.WzImj4ihf8/gpg.0.sh --keyring /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
      4⤵
      PID:1392
  - - /usr/sbin/sh
      sh /tmp/apt-key-gpghome.WzImj4ihf8/gpg.0.sh --keyring /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
      4⤵
      PID:1392
  - - /usr/bin/sh
      sh /tmp/apt-key-gpghome.WzImj4ihf8/gpg.0.sh --keyring /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
      4⤵
      PID:1392
  - - /sbin/sh
      sh /tmp/apt-key-gpghome.WzImj4ihf8/gpg.0.sh --keyring /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
      4⤵
      PID:1392
  - - /bin/sh
      sh /tmp/apt-key-gpghome.WzImj4ihf8/gpg.0.sh --keyring /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
      4⤵
      PID:1392
  - - /usr/local/sbin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.WzImj4ihf8 --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
      4⤵
      PID:1392
  - - /usr/local/bin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.WzImj4ihf8 --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
      4⤵
      PID:1392
  - - /usr/sbin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.WzImj4ihf8 --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
      4⤵
      PID:1392
  - - /usr/bin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.WzImj4ihf8 --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.WzImj4ihf8/pubring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
      4⤵
      Writes file to tmp directory
      PID:1392
  - - /usr/bin/gpgconf
      gpgconf --kill gpg-agent
      4⤵
      Reads runtime system information
      PID:1393
    - - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        5⤵
        
        PID:1394
  - - /bin/rm
      rm -rf /tmp/apt-key-gpghome.WzImj4ihf8
      4⤵
      PID:1395
- /usr/bin/apt
  apt update
  2⤵
  - Writes file to tmp directory
  PID:1396
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1397
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1398
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:1399
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:1400
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1401
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1402
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    PID:1404
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    - Writes file to tmp directory
    PID:1405
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.OIeQQs /tmp/apt.data.4XGIiE
      4⤵
      Writes file to tmp directory
      PID:1407
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:1409
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1410
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:1411
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1412
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:1413
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1414
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:1415
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1416
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        
        PID:1417
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1418
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:1419
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1420
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:1422
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1423
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:1424
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.gamUzYaJnp
        5⤵
        
        PID:1425
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.gamUzYaJnp
        5⤵
        
        PID:1426
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.gamUzYaJnp/pubring.gpg
        5⤵
        
        PID:1427
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.gamUzYaJnp/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:1428
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:1429
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:1430
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:1431
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:1432
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:1435
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:1437
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:1439
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:1441
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:1443
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:1445
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:1447
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:1449
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:1451
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:1453
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.gamUzYaJnp/pubring.gpg /tmp/apt-key-gpghome.gamUzYaJnp/pubring.orig.gpg
        5⤵
        
        PID:1454
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:1457
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:1460
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.gamUzYaJnp --keyring /tmp/apt-key-gpghome.gamUzYaJnp/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.OIeQQs /tmp/apt.data.4XGIiE
        5⤵
        
        PID:1461
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        
        PID:1462
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        
        PID:1463
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.gamUzYaJnp
        5⤵
        
        PID:1464
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.Uwx20Z /tmp/apt.data.9YPr0p
      4⤵
      Writes file to tmp directory
      PID:1466
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        
        PID:1468
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1469
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:1470
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1471
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:1472
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1473
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:1474
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1475
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        Reads runtime system information
        
        PID:1476
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1477
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:1478
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:1479
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:1481
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:1482
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:1483
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.omXWoo5m6i
        5⤵
        
        PID:1484
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.omXWoo5m6i
        5⤵
        
        PID:1485
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.omXWoo5m6i/pubring.gpg
        5⤵
        
        PID:1486
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.omXWoo5m6i/pubring.gpg
        5⤵
        
        PID:1487
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:1488
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1489
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:1490
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:1491
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:1494
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:1496
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:1498
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:1500
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:1502
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:1504
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:1506
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:1508
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:1510
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:1512
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.omXWoo5m6i/pubring.gpg /tmp/apt-key-gpghome.omXWoo5m6i/pubring.orig.gpg
        5⤵
        Reads runtime system information
        
        PID:1513
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:1516
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:1519
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.omXWoo5m6i --keyring /tmp/apt-key-gpghome.omXWoo5m6i/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.Uwx20Z /tmp/apt.data.9YPr0p
        5⤵
        Reads runtime system information
        
        PID:1520
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        
        PID:1521
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        
        PID:1522
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.omXWoo5m6i
        5⤵
        
        PID:1523
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
      4⤵
      PID:1525
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        
        PID:1527
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:1528
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:1529
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1530
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:1531
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1532
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:1533
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1534
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        
        PID:1535
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1536
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:1537
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1538
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:1540
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1541
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:1542
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.MEsSiO3JfC
        5⤵
        
        PID:1543
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.MEsSiO3JfC
        5⤵
        
        PID:1544
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.MEsSiO3JfC/pubring.gpg
        5⤵
        
        PID:1545
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.MEsSiO3JfC/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:1546
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:1547
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1548
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:1549
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:1550
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:1553
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:1555
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:1557
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:1559
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:1561
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:1563
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:1565
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:1567
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:1569
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:1571
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.MEsSiO3JfC/pubring.gpg /tmp/apt-key-gpghome.MEsSiO3JfC/pubring.orig.gpg
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1572
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:1575
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:1578
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.MEsSiO3JfC --keyring /tmp/apt-key-gpghome.MEsSiO3JfC/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        
        PID:1579
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:1580
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        
        PID:1581
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.MEsSiO3JfC
        5⤵
        
        PID:1582
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.qBy4yx /tmp/apt.data.LDnv5K
      4⤵
      PID:1584
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:1586
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1587
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:1588
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1589
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:1590
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1591
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:1592
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1593
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:1595
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:1596
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:1597
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.ZIP476CxXI
        5⤵
        System Network Configuration Discovery
        
        PID:1598
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:1602
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:1605
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.ZIP476CxXI --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.qBy4yx /tmp/apt.data.LDnv5K
        5⤵
        System Network Configuration Discovery
        
        PID:1607
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:1608
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        
        PID:1609
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.ZIP476CxXI
        5⤵
        System Network Configuration Discovery
        
        PID:1610
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1611

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Modify Authentication Process

T1556

Pluggable Authentication Modules

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules