Analysis
- user interaction
yes - max time kernel
28s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
02/07/2026, 15:58
General
- Target NIH-IR-Linux-v7-portable-toolkit.sh
- Size 118KB
- Sample260702-ter6fahs7x
- SHA256 9b3a227eb4efe6ed55f4e6bbf3a498a78dfcbf124e6b0e36b1a3f6fc083cfc68
Score
7/10
Malware Config
Signatures
- Looks for SUID binaries 64 IoCs
Searches the filesystem for potential binaries to be used for privilege escalation (common during reconnaissance activity).
- OS Credential Dumping 1 TTPs 1 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 16 IoCs
Abuse sudo or cached sudo credentials to execute code.
- Reads AppArmor ptrace settings 1 TTPs 1 IoCs
Discovery of allowed ptrace capabilities by AppArmor.
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Enumerates active TCP sockets 1 TTPs 2 IoCs
Gets active TCP sockets from /proc virtual filesystem.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads hardware information 1 TTPs 2 IoCs
Accesses system info like serial numbers, manufacturer names etc.
- Reads list of loaded kernel modules 1 TTPs 1 IoCs
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
- Reads network interface configuration 2 TTPs 14 IoCs
Fetches information about one or more active network interfaces.
- Virtualization/Sandbox Evasion: Time Based Evasion 1 TTPs 1 IoCs
Adversaries may detect and evade virtualized environments and sandboxes.
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
- Changes its process name 3 IoCs
- Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 27 IoCs
- Reads system network configuration 1 TTPs 37 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs
Execute scripts via Unix Shell.
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 6 IoCs
Adversaries may gather information about the network configuration of a system.
- System Time Discovery 1 TTPs 1 IoCs
Adversaries may attempt to gather the system's date and time settings.
- Writes file to tmp directory 64 IoCs
Malware often drops required files in the /tmp directory.
- Software Deployment Tools 1 TTPs 2 IoCs
Use software deployment tools to execute code.
Processes
-
/tmp/NIH-IR-Linux-v7-portable-toolkit.sh/tmp/NIH-IR-Linux-v7-portable-toolkit.sh1⤵
-
/usr/local/sbin/bashbash /tmp/NIH-IR-Linux-v7-portable-toolkit.sh1⤵
-
/usr/local/bin/bashbash /tmp/NIH-IR-Linux-v7-portable-toolkit.sh1⤵
-
/usr/sbin/bashbash /tmp/NIH-IR-Linux-v7-portable-toolkit.sh1⤵
-
/usr/bin/bashbash /tmp/NIH-IR-Linux-v7-portable-toolkit.sh1⤵
-
/sbin/bashbash /tmp/NIH-IR-Linux-v7-portable-toolkit.sh1⤵
-
/bin/bashbash /tmp/NIH-IR-Linux-v7-portable-toolkit.sh1⤵
- Writes file to tmp directory
-
/bin/datedate "+%s"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/hostnamehostname2⤵
-
-
/bin/datedate "+%Y%m%d_%H%M%S"2⤵
-
-
/usr/bin/idid -un2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-v7-portable-toolkit.sh2⤵
-
-
/usr/bin/basenamebasename /tmp/NIH-IR-Linux-v7-portable-toolkit.sh2⤵
-
-
/usr/bin/awkawk "-F=" "/^ID=/{gsub(/\"/,\"\",\$2); print \$2}" /etc/os-release2⤵
-
-
/usr/bin/awkawk "-F=" "/^VERSION_ID=/{gsub(/\"/,\"\",\$2); print \$2}" /etc/os-release2⤵
-
-
/usr/bin/nprocnproc2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/004_NETWORK2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/005_FILESYSTEM2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/006_PERSISTENCE2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/007_LOGS2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/008_BROWSER2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/009_CONTAINERS2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/010_CLOUD2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/011_MEMORY2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/012_HASHES2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/013_TIMELINE2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/014_FINDINGS2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/015_REPORTS2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/016_PLUGINS2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/017_IMAGE2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/018_COVERAGE2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Version.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Version.txt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Collector_Metadata.json2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Collector_Metadata.json2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Executive_Summary.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Executive_Summary.txt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Technical_Summary.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Technical_Summary.txt2⤵
-
-
/usr/bin/findfind /home -mindepth 1 -maxdepth 1 -type d -print02⤵
-
-
/usr/bin/trtr -c A-Za-z0-9_.- _2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/hostnamectl.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/usr/bin/hostnamectlhostnamectl2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/hostnamectl.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/hostnamectl.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/uname.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/unameuname -a2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/uname.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/uname.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/os-release.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/readlinkreadlink -f /etc/os-release2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/os-release.txt.symlink_info.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/os-release.txt.symlink_info.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/uptime.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/usr/bin/uptimeuptime2⤵
- Virtualization/Sandbox Evasion: Time Based Evasion
- Reads CPU attributes
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/uptime.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/uptime.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/timedatectl.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/usr/bin/timedatectltimedatectl2⤵
- System Time Discovery
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/timedatectl.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/timedatectl.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/cpuinfo.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/cpcp -p --no-clobber /proc/cpuinfo /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/cpuinfo.txt2⤵
- Checks CPU configuration
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/cpuinfo.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/cpuinfo.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/meminfo.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/cpcp -p --no-clobber /proc/meminfo /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/meminfo.txt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/meminfo.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/meminfo.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/free.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/usr/bin/freefree -h2⤵
- Reads CPU attributes
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/free.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/free.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/swapon.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/sbin/swaponswapon --show2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/swapon.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/swapon.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/env.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/usr/bin/envenv2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/env.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/env.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/systemd-detect-virt.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/usr/bin/systemd-detect-virtsystemd-detect-virt2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/systemd-detect-virt.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/systemd-detect-virt.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/dmidecode.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/usr/sbin/dmidecodedmidecode2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/dmidecode.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/dmidecode.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/mount.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/mountmount2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/mount.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/mount.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/fstab.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/cpcp -p --no-clobber /etc/fstab /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/fstab.txt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/fstab.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/fstab.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/lsblk.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/lsblklsblk -f2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/lsblk.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/lsblk.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/blkid.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/sbin/blkidblkid2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/blkid.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/blkid.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/findmnt.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/findmntfindmnt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/findmnt.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/findmnt.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/df.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/dfdf -h2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/df.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/df.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/lsmod.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/sbin/lsmodlsmod2⤵
- Reads list of loaded kernel modules
- Enumerates kernel/hardware configuration
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/lsmod.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/lsmod.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/systemctl_list_units.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/systemctlsystemctl list-units --all --no-pager2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/systemctl_list_units.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/systemctl_list_units.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/systemctl_list_unit_files.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/systemctlsystemctl list-unit-files --no-pager2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/systemctl_list_unit_files.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/systemctl_list_unit_files.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/packages_dpkg.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/usr/bin/dpkgdpkg -l2⤵
- Software Deployment Tools
-
-
/usr/local/sbin/dpkg-querydpkg-query --list --2⤵
-
-
/usr/local/bin/dpkg-querydpkg-query --list --2⤵
-
-
/usr/sbin/dpkg-querydpkg-query --list --2⤵
-
-
/usr/bin/dpkg-querydpkg-query --list --2⤵
- Software Deployment Tools
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/packages_dpkg.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/packages_dpkg.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/kernel_cmdline.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/cpcp -p --no-clobber /proc/cmdline /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/kernel_cmdline.txt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/kernel_cmdline.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/kernel_cmdline.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/grub.cfg2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM2⤵
-
-
/bin/cpcp -p --no-clobber /boot/grub/grub.cfg /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/grub.cfg2⤵
- Writes file to tmp directory
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/grub.cfg2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/001_SYSTEM/grub.cfg2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Module_001_SYSTEM.status2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Module_001_SYSTEM.status2⤵
-
-
/usr/bin/trtr -c A-Za-z0-9_.- _2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/passwd.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/bin/cpcp -p --no-clobber /etc/passwd /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/passwd.txt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/passwd.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/passwd.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/group.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/bin/cpcp -p --no-clobber /etc/group /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/group.txt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/group.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/group.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.txt2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/bin/cpcp -p --no-clobber /etc/sudoers /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.txt2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.txt2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.txt2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.d2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/usr/bin/timeouttimeout 180 cp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.d/2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/local/sbin/cpcp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.d/3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/usr/local/bin/cpcp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.d/3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/usr/sbin/cpcp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.d/3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/usr/bin/cpcp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.d/3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/sbin/cpcp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.d/3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
-
/bin/cpcp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/sudoers.d/3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Writes file to tmp directory
-
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/shadow.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/bin/cpcp -p --no-clobber /etc/shadow /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/shadow.txt2⤵
- OS Credential Dumping
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/shadow.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/shadow.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/gshadow.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/bin/cpcp -p --no-clobber /etc/gshadow /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/gshadow.txt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/gshadow.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/gshadow.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/who.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/usr/bin/whowho2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/who.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/who.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/w.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/usr/bin/ww2⤵
- Reads CPU attributes
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/w.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/w.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/users.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/usr/bin/usersusers2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/users.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/users.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/last.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/usr/bin/lastlast -Faixw2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/last.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/last.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/lastb.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/usr/bin/lastblastb -Faixw2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/lastb.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/lastb.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/lastlog.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/usr/bin/lastloglastlog2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/lastlog.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/lastlog.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/faillog.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/usr/bin/faillogfaillog2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/faillog.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/faillog.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/loginctl_sessions.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/bin/loginctlloginctl list-sessions2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/loginctl_sessions.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/loginctl_sessions.txt2⤵
-
-
/usr/bin/basenamebasename /home/user2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/bashrc_user.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/bin/cpcp -p --no-clobber /home/user/.bashrc /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/bashrc_user.txt2⤵
- Writes file to tmp directory
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/bashrc_user.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/bashrc_user.txt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/basenamebasename /root2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/bashrc_root.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS2⤵
-
-
/bin/cpcp -p --no-clobber /root/.bashrc /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/bashrc_root.txt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/bashrc_root.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/002_USERS/bashrc_root.txt2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Module_002_USERS.status2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/000_CASE_INFO/Module_002_USERS.status2⤵
-
-
/usr/bin/trtr -c A-Za-z0-9_.- _2⤵
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/ps_auxww.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES2⤵
-
-
/bin/psps auxww2⤵
- Reads CPU attributes
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/ps_auxww.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/ps_auxww.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/ps_ef.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES2⤵
-
-
/bin/psps -ef2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/ps_ef.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/ps_ef.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/pstree.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES2⤵
-
-
/usr/bin/pstreepstree -ap2⤵
- Reads runtime system information
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/pstree.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/pstree.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/top_snapshot.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES2⤵
-
-
/usr/bin/toptop -b -n 12⤵
- Reads CPU attributes
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/top_snapshot.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/top_snapshot.txt2⤵
-
-
/usr/bin/dirnamedirname /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/lsof.txt2⤵
-
-
/bin/mkdirmkdir -p /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES2⤵
-
-
/usr/bin/lsoflsof -n -P2⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
-
-
/bin/datedate -u "+%Y-%m-%dT%H:%M:%SZ"2⤵
-
-
/usr/bin/statstat "-c%s" /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/lsof.txt2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/sha256sumsha256sum /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/lsof.txt2⤵
-
-
/usr/bin/basenamebasename /proc/12⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /lib/systemd/systemd2⤵
-
-
/usr/bin/basenamebasename /proc/102⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/10/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_10.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/10/exe2⤵
-
-
/usr/bin/basenamebasename /proc/10012⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1001/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1001.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1001/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/evolution/evolution-source-registry2⤵
-
-
/usr/bin/basenamebasename /proc/10102⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1010/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1010.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1010/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-online-accounts/goa-daemon2⤵
-
-
/usr/bin/basenamebasename /proc/10182⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1018/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1018.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1018/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/x86_64-linux-gnu/boltd2⤵
-
-
/usr/bin/basenamebasename /proc/10282⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1028/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1028.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1028/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-online-accounts/goa-identity-service2⤵
-
-
/usr/bin/basenamebasename /proc/10332⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1033/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1033.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1033/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gvfs/gvfs-udisks2-volume-monitor2⤵
-
-
/usr/bin/basenamebasename /proc/10372⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1037/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1037.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1037/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gvfs/gvfs-gphoto2-volume-monitor2⤵
-
-
/usr/bin/basenamebasename /proc/10412⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1041/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1041.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1041/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gvfs/gvfs-goa-volume-monitor2⤵
-
-
/usr/bin/basenamebasename /proc/10452⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1045/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1045.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/1045/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gvfs/gvfs-mtp-volume-monitor2⤵
-
-
/usr/bin/basenamebasename /proc/10492⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1049/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1049.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1049/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gvfs/gvfs-afc-volume-monitor2⤵
-
-
/usr/bin/basenamebasename /proc/10542⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1054/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1054.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1054/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/packagekit/packagekitd2⤵
-
-
/usr/bin/basenamebasename /proc/10582⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1058/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1058.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/1058/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-power2⤵
-
-
/usr/bin/basenamebasename /proc/10592⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1059/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1059.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1059/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-print-notifications2⤵
-
-
/usr/bin/basenamebasename /proc/10622⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1062/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1062.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1062/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-rfkill2⤵
-
-
/usr/bin/basenamebasename /proc/10632⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1063/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1063.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1063/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-screensaver-proxy2⤵
-
-
/usr/bin/basenamebasename /proc/10662⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1066/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1066.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1066/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-sharing2⤵
-
-
/usr/bin/basenamebasename /proc/10752⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1075/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1075.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1075/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-xsettings2⤵
-
-
/usr/bin/basenamebasename /proc/10762⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1076/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1076.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1076/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-wacom2⤵
-
-
/usr/bin/basenamebasename /proc/10782⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1078/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1078.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/1078/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-smartcard2⤵
-
-
/usr/bin/basenamebasename /proc/10792⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1079/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1079.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1079/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-sound2⤵
-
-
/usr/bin/basenamebasename /proc/10872⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1087/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1087.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1087/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-a11y-settings2⤵
-
-
/usr/bin/basenamebasename /proc/10942⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1094/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1094.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1094/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-clipboard2⤵
-
-
/usr/bin/basenamebasename /proc/10972⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1097/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1097.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1097/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-color2⤵
-
-
/usr/bin/basenamebasename /proc/10992⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1099/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1099.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1099/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-datetime2⤵
-
-
/usr/bin/basenamebasename /proc/112⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/11/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_11.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/11/exe2⤵
-
-
/usr/bin/basenamebasename /proc/11002⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1100/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1100.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1100/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-housekeeping2⤵
-
-
/usr/bin/basenamebasename /proc/11012⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1101/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1101.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1101/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-keyboard2⤵
-
-
/usr/bin/basenamebasename /proc/11042⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1104/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1104.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1104/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-media-keys2⤵
-
-
/usr/bin/basenamebasename /proc/11062⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1106/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1106.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1106/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-mouse2⤵
-
-
/usr/bin/basenamebasename /proc/11472⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1147/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1147.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1147/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/colord/colord2⤵
-
-
/usr/bin/basenamebasename /proc/1152⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/115/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_115.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/115/exe2⤵
-
-
/usr/bin/basenamebasename /proc/11582⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1158/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1158.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1158/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-settings-daemon/gsd-printer2⤵
-
-
/usr/bin/basenamebasename /proc/11612⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1161/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1161.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1161/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/bin/nautilus-desktop2⤵
-
-
/usr/bin/basenamebasename /proc/11642⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1164/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1164.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1164/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-disk-utility/gsd-disk-utility-notify2⤵
-
-
/usr/bin/basenamebasename /proc/11812⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1181/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1181.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1181/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gvfs/gvfsd-trash2⤵
-
-
/usr/bin/basenamebasename /proc/11982⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1198/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1198.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1198/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/evolution/evolution-calendar-factory2⤵
-
-
/usr/bin/basenamebasename /proc/122⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/12/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_12.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/12/exe2⤵
-
-
/usr/bin/basenamebasename /proc/12082⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1208/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1208.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1208/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gnome-terminal/gnome-terminal-server2⤵
-
-
/usr/bin/basenamebasename /proc/12512⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1251/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1251.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1251/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/NetworkManager2⤵
-
-
/usr/bin/basenamebasename /proc/12562⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1256/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1256.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1256/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /sbin/dhclient2⤵
-
-
/usr/bin/basenamebasename /proc/132⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/13/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_13.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/13/exe2⤵
-
-
/usr/bin/basenamebasename /proc/13082⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1308/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1308.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1308/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/dconf/dconf-service2⤵
-
-
/usr/bin/basenamebasename /proc/13142⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1314/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1314.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1314/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/evolution/evolution-calendar-factory-subprocess2⤵
-
-
/usr/bin/basenamebasename /proc/13152⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1315/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1315.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/1315/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/ibus/ibus-engine-simple2⤵
-
-
/usr/bin/basenamebasename /proc/13302⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1330/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1330.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1330/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /bin/bash2⤵
-
-
/usr/bin/basenamebasename /proc/13352⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1335/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1335.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1335/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/evolution/evolution-addressbook-factory2⤵
-
-
/usr/bin/basenamebasename /proc/13532⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1353/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1353.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1353/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/evolution/evolution-addressbook-factory-subprocess2⤵
-
-
/usr/bin/basenamebasename /proc/1372⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/137/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_137.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/137/exe2⤵
-
-
/usr/bin/basenamebasename /proc/13842⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1384/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1384.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/1384/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/bin/gnome-software2⤵
-
-
/usr/bin/basenamebasename /proc/142⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/14/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_14.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/14/exe2⤵
-
-
/usr/bin/basenamebasename /proc/14592⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1459/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1459.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1459/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/deja-dup/deja-dup-monitor2⤵
-
-
/usr/bin/basenamebasename /proc/14842⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1484/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1484.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1484/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /lib/systemd/systemd-timedated2⤵
-
-
/usr/bin/basenamebasename /proc/14872⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1487/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1487.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1487/exe2⤵
-
-
/usr/bin/basenamebasename /proc/14892⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1489/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1489.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1489/exe2⤵
-
-
/usr/bin/basenamebasename /proc/14922⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1492/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1492.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1492/exe2⤵
-
-
/usr/bin/basenamebasename /proc/14942⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1494/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1494.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1494/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /bin/bash2⤵
-
-
/usr/bin/basenamebasename /proc/152⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/15/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_15.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/15/exe2⤵
-
-
/usr/bin/basenamebasename /proc/15652⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1565/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1565.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1565/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/agent2⤵
-
-
/usr/bin/basenamebasename /proc/15742⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/1574/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_1574.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/1574/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /lib/systemd/systemd-hostnamed2⤵
-
-
/usr/bin/basenamebasename /proc/1592⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/159/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_159.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/159/exe2⤵
-
-
/usr/bin/basenamebasename /proc/162⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/16/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_16.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/16/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1602⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/160/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_160.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/160/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1612⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/161/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_161.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/161/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1622⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/162/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_162.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/162/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1632⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/163/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_163.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/163/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1642⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/164/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_164.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/164/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1652⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/165/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_165.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/165/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1662⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/166/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_166.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/166/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1672⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/167/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_167.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/167/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1682⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/168/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_168.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/168/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1692⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/169/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_169.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/169/exe2⤵
-
-
/usr/bin/basenamebasename /proc/172⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/17/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_17.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/17/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1702⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/170/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_170.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/170/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1712⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/171/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_171.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/171/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1722⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/172/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_172.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/172/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1732⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/173/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_173.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/173/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1742⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/174/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_174.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/174/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1752⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/175/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_175.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/175/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1762⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/176/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_176.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/176/exe2⤵
-
-
/usr/bin/basenamebasename /proc/1782⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/178/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_178.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/178/exe2⤵
-
-
/usr/bin/basenamebasename /proc/182⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/18/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_18.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/18/exe2⤵
-
-
/usr/bin/basenamebasename /proc/192⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/19/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_19.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/19/exe2⤵
-
-
/usr/bin/basenamebasename /proc/22⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/2/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_2.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/2/exe2⤵
-
-
/usr/bin/basenamebasename /proc/202⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/20/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_20.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/20/exe2⤵
-
-
/usr/bin/basenamebasename /proc/2032⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/203/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_203.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/203/exe2⤵
-
-
/usr/bin/basenamebasename /proc/2042⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/204/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_204.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/204/exe2⤵
-
-
/usr/bin/basenamebasename /proc/212⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/21/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_21.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/21/exe2⤵
-
-
/usr/bin/basenamebasename /proc/222⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/22/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_22.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/22/exe2⤵
-
-
/usr/bin/basenamebasename /proc/232⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/23/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_23.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/23/exe2⤵
-
-
/usr/bin/basenamebasename /proc/242⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/24/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_24.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/24/exe2⤵
-
-
/usr/bin/basenamebasename /proc/2432⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/243/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_243.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/243/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /lib/systemd/systemd-journald2⤵
-
-
/usr/bin/basenamebasename /proc/252⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/25/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_25.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/25/exe2⤵
-
-
/usr/bin/basenamebasename /proc/262⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/26/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_26.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/26/exe2⤵
-
-
/usr/bin/basenamebasename /proc/272⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/27/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_27.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/27/exe2⤵
-
-
/usr/bin/basenamebasename /proc/2702⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/270/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_270.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/270/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /lib/systemd/systemd-udevd2⤵
-
-
/usr/bin/basenamebasename /proc/282⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/28/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_28.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/28/exe2⤵
-
-
/usr/bin/basenamebasename /proc/292⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/29/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_29.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/29/exe2⤵
-
-
/usr/bin/basenamebasename /proc/32⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/3/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_3.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/3/exe2⤵
-
-
/usr/bin/basenamebasename /proc/302⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/30/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_30.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/30/exe2⤵
-
-
/usr/bin/basenamebasename /proc/312⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/31/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_31.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/31/exe2⤵
-
-
/usr/bin/basenamebasename /proc/3182⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/318/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_318.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/318/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /sbin/auditd2⤵
-
-
/usr/bin/basenamebasename /proc/322⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/32/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_32.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/32/exe2⤵
-
-
/usr/bin/basenamebasename /proc/3242⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/324/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_324.txt2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink -f /proc/324/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /lib/systemd/systemd-resolved2⤵
-
-
/usr/bin/basenamebasename /proc/342⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/34/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_34.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/34/exe2⤵
-
-
/usr/bin/basenamebasename /proc/352⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/35/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_35.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/35/exe2⤵
-
-
/usr/bin/basenamebasename /proc/362⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/36/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_36.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/36/exe2⤵
-
-
/usr/bin/basenamebasename /proc/42⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/4/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_4.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/4/exe2⤵
-
-
/usr/bin/basenamebasename /proc/4372⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/437/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_437.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/437/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/bin/dbus-daemon2⤵
-
-
/usr/bin/basenamebasename /proc/4592⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/459/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_459.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/459/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/avahi-daemon2⤵
-
-
/usr/bin/basenamebasename /proc/4602⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/460/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_460.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/460/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/avahi-daemon2⤵
-
-
/usr/bin/basenamebasename /proc/4612⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/461/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_461.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/461/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /sbin/wpa_supplicant2⤵
-
-
/usr/bin/basenamebasename /proc/4622⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/462/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_462.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/462/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/atd2⤵
-
-
/usr/bin/basenamebasename /proc/4632⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/463/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_463.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/463/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/accountsservice/accounts-daemon2⤵
-
-
/usr/bin/basenamebasename /proc/4672⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/467/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_467.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/467/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/snapd/snapd2⤵
-
-
/usr/bin/basenamebasename /proc/4682⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/468/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_468.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/468/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/bin/python3.62⤵
-
-
/usr/bin/basenamebasename /proc/4692⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/469/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_469.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/469/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/rsyslogd2⤵
-
-
/usr/bin/basenamebasename /proc/4702⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/470/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_470.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/470/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/udisks2/udisksd2⤵
-
-
/usr/bin/basenamebasename /proc/52⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/5/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_5.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/5/exe2⤵
-
-
/usr/bin/basenamebasename /proc/5022⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/502/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_502.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/502/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/cron2⤵
-
-
/usr/bin/basenamebasename /proc/5102⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/510/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_510.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/510/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /lib/systemd/systemd-logind2⤵
-
-
/usr/bin/basenamebasename /proc/5112⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/511/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_511.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/511/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/anacron2⤵
-
-
/usr/bin/basenamebasename /proc/5142⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/514/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_514.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/514/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/acpid2⤵
-
-
/usr/bin/basenamebasename /proc/5152⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/515/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_515.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/515/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/ModemManager2⤵
-
-
/usr/bin/basenamebasename /proc/5162⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/516/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_516.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/516/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/cupsd2⤵
-
-
/usr/bin/basenamebasename /proc/5462⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/546/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_546.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/546/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/policykit-1/polkitd2⤵
-
-
/usr/bin/basenamebasename /proc/5492⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/549/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_549.txt2⤵
- Writes file to tmp directory
-
-
/bin/readlinkreadlink -f /proc/549/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/cups-browsed2⤵
-
-
/usr/bin/basenamebasename /proc/5572⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/557/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_557.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/557/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/bin/python3.62⤵
-
-
/usr/bin/basenamebasename /proc/5642⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/564/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_564.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/564/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/sshd2⤵
-
-
/usr/bin/basenamebasename /proc/5762⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/576/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_576.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/576/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/sbin/gdm32⤵
-
-
/usr/bin/basenamebasename /proc/5962⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/596/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_596.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/596/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/lib/gdm3/gdm-session-worker2⤵
-
-
/usr/bin/basenamebasename /proc/62⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/6/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_6.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/6/exe2⤵
-
-
/usr/bin/basenamebasename /proc/6122⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/612/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_612.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/612/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /lib/systemd/systemd2⤵
-
-
/usr/bin/basenamebasename /proc/6132⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/613/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_613.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/613/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /lib/systemd/systemd2⤵
-
-
/usr/bin/basenamebasename /proc/6482⤵
-
-
/usr/bin/trtr "\\0" "\\n"2⤵
-
-
/bin/cpcp -p /proc/648/status /tmp/NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841/003_PROCESSES/status_648.txt2⤵
-
-
/bin/readlinkreadlink -f /proc/648/exe2⤵
-
-
/usr/bin/sha256sumsha256sum /usr/bin/gnome-keyring-daemon2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Unix Shell
1Software Deployment Tools
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Virtualization/Sandbox Evasion
4System Checks
2Time Based Evasion
1Credential Access
OS Credential Dumping
2/etc/passwd and /etc/shadow
1Proc Filesystem
1Replay Monitor
Loading Replay Monitor...
Downloads
NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841.SHA256SUMS.txt
NIH-IR-Linux-ubuntu1804-amd64-20260513-en-13-20260702_165841.tar.gz
ziuwc06d
blkid.tab
Collection_Duration.txt
Collection_Statistics.txt
Collection_Summary.txt
Collection_Summary.txt
Collector.log
Collector.log
Collector.log
Collector.log
Collector.log
Collector_Metadata.json
Collector_Metadata.json
Executive_Summary.txt
Manifest.csv
Manifest.csv
Manifest.csv
Manifest.csv
Manifest.csv
Module_001_SYSTEM.status
Module_001_SYSTEM.status
Module_002_USERS.status
Module_002_USERS.status
Module_003_PROCESSES.status
Module_003_PROCESSES.status
Module_004_NETWORK.status
Module_004_NETWORK.status
Module_005_FILESYSTEM.status
Module_005_FILESYSTEM.status
Module_006_PERSISTENCE.status
Module_006_PERSISTENCE.status
Module_007_LOGS.status
Module_007_LOGS.status
Module_008_BROWSER.status
Module_008_BROWSER.status
Module_009_CONTAINERS.status
Module_009_CONTAINERS.status
Module_010_CLOUD.status
Module_010_CLOUD.status
Module_011_MEMORY.status
Module_011_MEMORY.status
Module_013_TIMELINE.status
Module_013_TIMELINE.status
Module_014_IOC_SCAN.status
Module_014_IOC_SCAN.status
Module_014_THREAT_HUNTING.status
Module_014_THREAT_HUNTING.status
Module_014_YARA_SCAN.status
Module_014_YARA_SCAN.status
Module_016_PLUGINS.status
Module_016_PLUGINS.status
Module_018_COVERAGE.status
Module_018_COVERAGE.status
Technical_Summary.txt
Technical_Summary.txt
Version.txt
blkid.txt
cpuinfo.txt
df.txt
dmidecode.txt
env.txt
findmnt.txt
free.txt
fstab.txt
grub.cfg
hostnamectl.txt
kernel_cmdline.txt
lsblk.txt
lsmod.txt
meminfo.txt
mount.txt
os-release.txt.symlink_info.txt
packages_dpkg.txt
swapon.txt
systemctl_list_unit_files.txt
systemctl_list_units.txt
systemd-detect-virt.txt
timedatectl.txt
uname.txt
uptime.txt
bashrc_root.txt
bashrc_user.txt
group.txt
gshadow.txt
last.txt
lastb.txt
lastlog.txt
loginctl_sessions.txt
passwd.txt
shadow.txt
README
user
sudoers.txt
users.txt
who.txt
Executable_Hashes.sha256
Executable_Hashes.sha256
Executable_Hashes.sha256
Executable_Hashes.sha256
Executable_Hashes.sha256
environ_1.txt
environ_1001.txt
environ_1010.txt
environ_1018.txt
environ_1033.txt
environ_1037.txt
environ_1041.txt
environ_1045.txt
environ_1049.txt
environ_1054.txt
environ_1058.txt
environ_1059.txt
environ_1062.txt
environ_1063.txt
environ_1066.txt
environ_1075.txt
environ_1076.txt
environ_1078.txt
environ_1079.txt
environ_1087.txt
environ_1094.txt
environ_1097.txt
environ_1099.txt
environ_1100.txt
environ_1101.txt
environ_1104.txt
environ_1106.txt
environ_1147.txt
environ_1161.txt
environ_1164.txt
environ_1181.txt
environ_1198.txt
environ_1208.txt
environ_1251.txt
environ_1256.txt
environ_1315.txt
environ_1330.txt
environ_1335.txt
environ_1384.txt
environ_1459.txt
environ_1484.txt
environ_1494.txt
environ_1565.txt
environ_1574.txt
environ_243.txt
environ_270.txt
environ_318.txt
environ_324.txt
environ_437.txt
environ_459.txt
environ_460.txt
environ_461.txt
environ_462.txt
environ_463.txt
environ_467.txt
environ_468.txt
environ_469.txt
environ_470.txt
environ_502.txt
environ_510.txt
environ_511.txt
environ_514.txt
environ_515.txt
environ_516.txt
environ_546.txt
environ_549.txt
environ_557.txt
environ_564.txt
environ_576.txt
environ_596.txt
environ_612.txt
environ_648.txt
environ_661.txt
environ_666.txt
environ_668.txt
environ_674.txt
environ_683.txt
environ_701.txt
environ_709.txt
environ_718.txt
environ_910.txt
environ_912.txt
environ_920.txt
environ_953.txt
environ_959.txt
environ_982.txt
lsof.txt
ps_auxww.txt
ps_ef.txt
pstree.txt
status_1.txt
status_10.txt
status_1001.txt
status_1010.txt
status_1018.txt
status_1028.txt
status_1033.txt
status_1037.txt
status_1041.txt
status_1045.txt
status_1049.txt
status_1054.txt
status_1058.txt
status_1059.txt
status_1062.txt
status_1063.txt
status_1066.txt
status_1075.txt
status_1076.txt
status_1078.txt
status_1079.txt
status_1087.txt
status_1094.txt
status_1097.txt
status_1099.txt
status_11.txt
status_1100.txt
status_1101.txt
status_1104.txt
status_1106.txt
status_1147.txt
status_115.txt
status_1158.txt
status_1161.txt
status_1164.txt
status_1181.txt
status_1198.txt
status_12.txt
status_1208.txt
status_1251.txt
status_1256.txt
status_13.txt
status_1308.txt
status_1314.txt
status_1315.txt
status_1330.txt
status_1335.txt
status_1353.txt
status_137.txt
status_1384.txt
status_14.txt
status_1459.txt
status_1484.txt
status_1487.txt
status_1489.txt
status_1492.txt
status_1494.txt
status_15.txt
status_1565.txt
status_1574.txt
status_159.txt
status_16.txt
status_160.txt
status_161.txt
status_162.txt
status_163.txt
status_164.txt
status_165.txt
status_166.txt
status_167.txt
status_168.txt
status_169.txt
status_17.txt
status_170.txt
status_171.txt
status_172.txt
status_173.txt
status_174.txt
status_175.txt
status_176.txt
status_178.txt
status_18.txt
status_19.txt
status_2.txt
status_20.txt
status_203.txt
status_204.txt
status_21.txt
status_22.txt
status_23.txt
status_24.txt
status_243.txt
status_25.txt
status_26.txt
status_27.txt
status_270.txt
status_28.txt
status_29.txt
status_3.txt
status_30.txt
status_31.txt
status_318.txt
status_32.txt
status_324.txt
status_34.txt
status_35.txt
status_36.txt
status_4.txt
status_437.txt
status_459.txt
status_460.txt
status_461.txt
status_462.txt
status_463.txt
status_467.txt
status_468.txt
status_469.txt
status_470.txt
status_5.txt
status_502.txt
status_510.txt
status_511.txt
status_514.txt
status_515.txt
status_516.txt
status_546.txt
status_549.txt
status_557.txt
status_564.txt
status_576.txt
status_596.txt
status_6.txt
status_612.txt
status_613.txt
status_648.txt
status_661.txt
status_666.txt
status_668.txt
status_674.txt
status_683.txt
status_7.txt
status_701.txt
status_709.txt
status_718.txt
status_78.txt
status_79.txt
status_8.txt
status_80.txt
status_81.txt
status_82.txt
status_83.txt
status_84.txt
status_86.txt
status_89.txt
status_9.txt
status_910.txt
status_912.txt
status_917.txt
status_920.txt
status_934.txt
status_939.txt
status_953.txt
status_959.txt
status_973.txt
status_977.txt
status_979.txt
status_98.txt
status_982.txt
status_987.txt
status_997.txt
top_snapshot.txt
top_snapshot.txt
arp.txt
hosts.txt
ip_addr.txt
ip_link.txt
ip_neigh.txt
ip_route.txt
iptables.txt
iwconfig.txt
NetworkManager-intern.conf
dhclient-88fe0a39-a16b-33aa-8f14-2252a9a3cd74-ens3.lease
dhclient-ens3.conf
timestamps
nftables.txt
nmcli_devices.txt
resolv.conf.txt.symlink_info.txt
ss.txt
deleted_open_files.txt
file_capabilities.txt
hidden_files_home.txt
large_files_100mb.txt
recent_files_7d.txt
sgid_files.txt
suid_files.txt
tmp_devshm_files.txt
anacrontab.txt
bash.bashrc.txt
.placeholder
anacron
popularity-contest
0anacron
apport
apt-compat
bsdmainutils
cracklib-runtime
dpkg
logrotate
man-db
mlocate
passwd
popularity-contest
update-notifier-common
0anacron
0anacron
man-db
update-notifier-common
crontab.txt
acpid
alsa-utils
anacron
apparmor
apport
atd
auditd
avahi-daemon
bluetooth
console-setup.sh
cron
cups
cups-browsed
dbus
dns-clean
gdm3
grub-common
hwclock.sh
irqbalance
kerneloops
keyboard-setup.sh
kmod
network-manager
networking
plymouth
plymouth-log
pppd-dns
procps
rsync
rsyslog
saned
selinux-autorelabel
speech-dispatcher
spice-vdagent
ssh
udev
ufw
unattended-upgrades
uuidd
whoopsie
x11-common
cups-filters.conf
01-locale-fix.sh
apps-bin-path.sh
bash_completion.sh
cedilla-portuguese.sh
input-method-config.sh
vte-2.91.sh
xdg_dirs_desktop_session.sh
profile.txt
systemctl_list_timers.txt
.SEQ
Xorg.0.log.txt
audit.log.txt
auth.log.txt
dmesg.txt
journalctl_all.txt
journalctl_this_boot.txt
kern.log.txt
syslog.txt
Memory_Acquisition_Status.txt
iomem.txt
slabinfo.txt
sysctl_vm.txt
vmstat.txt
SHA256SUMS.txt
SHA256SUMS.txt
Master_Timeline.csv
Master_Timeline.csv
timeline_ctime.tmp
timeline_mtime.tmp
timeline_raw.tmp
timeline_raw.tmp
timeline_raw.tmp
timeline_raw.tmp
timeline_raw.tmp
Findings.csv
Findings.csv
IOC_Scan_Status.txt
YARA_Scan_Status.txt
IR_Report.md
IR_Report.md
Coverage_Report.txt
Coverage_Report.txt
Coverage_Report.txt
Coverage_Report.txt
Coverage_Report.txt