8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a

persistence privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/var/spool/cron/root	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/cron.d/network-dispatch	network-dispatch
File opened for modification	/etc/cron.daily/network-dispatch	network-dispatch
File opened for modification	/etc/cron.daily/network-dispatch	network-dispatch
File opened for modification	/etc/cron.daily/network-dispatch	Process not Found
File opened for modification	/etc/cron.hourly/network-dispatch	Process not Found
File opened for modification	/etc/cron.hourly/network-dispatch	network-dispatch
File opened for modification	/var/spool/cron/crontabs/root	network-dispatch
File opened for modification	/var/spool/cron/root	network-dispatch
File opened for modification	/etc/cron.daily/network-dispatch	Process not Found
File opened for modification	/etc/cron.daily/network-dispatch	network-dispatch
File opened for modification	/etc/cron.daily/network-dispatch	network-dispatch
File opened for modification	/etc/cron.hourly/network-dispatch	network-dispatch
File opened for modification	/etc/cron.daily/network-dispatch	network-dispatch
File opened for modification	/etc/cron.hourly/network-dispatch	network-dispatch
File opened for modification	/etc/cron.d/network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/var/spool/cron/root	network-dispatch
File opened for modification	/etc/cron.d/network-dispatch	network-dispatch
File opened for modification	/var/spool/cron/root	Process not Found
File opened for modification	/etc/cron.d/network-dispatch	Process not Found
File opened for modification	/etc/cron.hourly/network-dispatch	network-dispatch
File opened for modification	/etc/cron.hourly/network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/cron.daily/network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/var/spool/cron/crontabs/root	network-dispatch
File opened for modification	/var/spool/cron/crontabs/root	network-dispatch
File opened for modification	/etc/cron.hourly/network-dispatch	network-dispatch
File opened for modification	/etc/cron.daily/network-dispatch	network-dispatch
File opened for modification	/etc/cron.hourly/network-dispatch	Process not Found
File opened for modification	/var/spool/cron/root	network-dispatch
File opened for modification	/var/spool/cron/root	network-dispatch
File opened for modification	/etc/cron.hourly/network-dispatch	network-dispatch
File opened for modification	/var/spool/cron/crontabs/root	Process not Found
File opened for modification	/var/spool/cron/crontabs/root	network-dispatch

Creates/modifies environment variables 1 TTPs 14 IoCs

Creating/modifying environment variables is a common persistence mechanism.

Path Interception by PATH Environment Variable

description	ioc	Process
File opened for modification	/etc/bash.bashrc	Process not Found
File opened for modification	/root/.profile	Process not Found
File opened for modification	/etc/bash.bashrc	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/root/.bash_profile	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/environment	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/profile.d/00-net.sh	Process not Found
File opened for modification	/root/.bashrc	Process not Found
File opened for modification	/root/.bash_profile	Process not Found
File opened for modification	/etc/profile.d/00-net.sh	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/root/.bashrc	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/root/.profile	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/profile	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/profile.d/00-net.sh	network-dispatch
File opened for modification	/etc/profile.d/00-net.sh	network-dispatch

Deletes log files 1 TTPs 12 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/.network-dispatch	Process not Found
File truncated	/var/log/.network-dispatch	network-dispatch
File truncated	/var/log/.network-dispatch	network-dispatch
File truncated	/var/log/.network-dispatch	network-dispatch
File truncated	/var/log/.network-dispatch	network-dispatch
File truncated	/var/log/.network-dispatch	Process not Found
File truncated	/var/log/.network-dispatch	Process not Found
File truncated	/var/log/.network-dispatch	Process not Found
File truncated	/var/log/.network-dispatch	Process not Found
File truncated	/var/log/.network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File truncated	/var/log/.network-dispatch	network-dispatch
File truncated	/var/log/.network-dispatch	network-dispatch

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 10 IoCs

Adds/modifies system service, likely for persistence.

Boot or Logon Autostart Execution

RC Scripts

description	ioc	Process
File opened for modification	/etc/init.d/network-dispatch	Process not Found
File opened for modification	/etc/init.d/network-dispatch	network-dispatch
File opened for modification	/etc/init.d/network-dispatch	network-dispatch
File opened for modification	/etc/init.d/network-dispatch	Process not Found
File opened for modification	/etc/init.d/network-dispatch	Process not Found
File opened for modification	/etc/init.d/network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/init.d/network-dispatch	network-dispatch
File opened for modification	/etc/init.d/network-dispatch	network-dispatch
File opened for modification	/etc/init.d/network-dispatch	network-dispatch
File opened for modification	/etc/init.d/network-dispatch	network-dispatch

Modifies rc script 2 TTPs 2 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

Boot or Logon Autostart Execution

RC Scripts

persistence privilege_escalation

description	ioc	Process
File opened for modification	/etc/rc.local	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/rc.local	network-dispatch

Modifies systemd 2 TTPs 12 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/network-dispatch.service	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/root/.config/systemd/user/network-dispatch.service	network-dispatch
File opened for modification	/root/.config/systemd/user/network-dispatch.service	network-dispatch
File opened for modification	/root/.config/systemd/user/network-dispatch.service	network-dispatch
File opened for modification	/root/.config/systemd/user/network-dispatch.service	Process not Found
File opened for modification	/root/.config/systemd/user/network-dispatch.service	Process not Found
File opened for modification	/etc/systemd/system/network-dispatch.service	Process not Found
File opened for modification	/root/.config/systemd/user/network-dispatch.service	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/root/.config/systemd/user/network-dispatch.service	network-dispatch
File opened for modification	/root/.config/systemd/user/network-dispatch.service	Process not Found
File opened for modification	/root/.config/systemd/user/network-dispatch.service	network-dispatch
File opened for modification	/root/.config/systemd/user/network-dispatch.service	network-dispatch

Write file to user bin folder 49 IoCs

description	ioc	Process
File opened for modification	/usr/bin/.network-dispatch	Process not Found
File opened for modification	/usr/sbin/.network-dispatch	Process not Found
File opened for modification	/usr/bin/.network-dispatch	network-dispatch
File opened for modification	/usr/sbin/.network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/watchdog-net	network-dispatch
File opened for modification	/usr/local/bin/watchdog-net	Process not Found
File opened for modification	/usr/local/bin/watchdog-net	network-dispatch
File opened for modification	/usr/bin/.network-dispatch	Process not Found
File opened for modification	/usr/sbin/.network-dispatch	Process not Found
File opened for modification	/usr/local/bin/network-dispatch	Process not Found
File opened for modification	/usr/sbin/.network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/usr/local/bin/watchdog-net	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/usr/sbin/.network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/watchdog-net	network-dispatch
File opened for modification	/usr/bin/.network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/watchdog-net	network-dispatch
File opened for modification	/usr/bin/.network-dispatch	network-dispatch
File opened for modification	/usr/bin/.network-dispatch	Process not Found
File opened for modification	/usr/bin/.network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/usr/local/bin/network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/watchdog-net	network-dispatch
File opened for modification	/usr/bin/.network-dispatch	network-dispatch
File opened for modification	/usr/bin/.network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/network-dispatch	Process not Found
File opened for modification	/usr/local/bin/network-dispatch	Process not Found
File opened for modification	/usr/local/bin/network-dispatch	network-dispatch
File opened for modification	/usr/sbin/.network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/watchdog-net	network-dispatch
File opened for modification	/usr/sbin/.network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/watchdog-net	Process not Found
File opened for modification	/usr/local/bin/watchdog-net	Process not Found
File opened for modification	/usr/bin/.network-dispatch	network-dispatch
File opened for modification	/usr/bin/.network-dispatch	Process not Found
File opened for modification	/usr/sbin/.network-dispatch	Process not Found
File opened for modification	/usr/local/bin/network-dispatch	Process not Found
File opened for modification	/usr/bin/.network-dispatch	Process not Found
File opened for modification	/usr/sbin/.network-dispatch	Process not Found
File opened for modification	/usr/bin/.network-dispatch	Process not Found
File opened for modification	/usr/sbin/.network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/network-dispatch	Process not Found
File opened for modification	/usr/sbin/.network-dispatch	Process not Found
File opened for modification	/usr/sbin/.network-dispatch	Process not Found
File opened for modification	/usr/local/bin/network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/usr/local/bin/network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/network-dispatch	network-dispatch
File opened for modification	/usr/sbin/.network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/network-dispatch	network-dispatch
File opened for modification	/usr/local/bin/network-dispatch	Process not Found

Writes file to system bin folder 13 IoCs

description	ioc	Process
File opened for modification	/sbin/.network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/sbin/.network-dispatch	network-dispatch
File opened for modification	/sbin/.network-dispatch	network-dispatch
File opened for modification	/sbin/.network-dispatch	network-dispatch
File opened for modification	/sbin/.network-dispatch	Process not Found
File opened for modification	/sbin/.network-dispatch	Process not Found
File opened for modification	/sbin/.network-dispatch	network-dispatch
File opened for modification	/sbin/.network-dispatch	network-dispatch
File opened for modification	/sbin/.network-dispatch	network-dispatch
File opened for modification	/sbin/.network-dispatch	Process not Found
File opened for modification	/sbin/.network-dispatch	Process not Found
File opened for modification	/sbin/.network-dispatch	Process not Found
File opened for modification	/sbin/.network-dispatch	Process not Found

Modifies Bash startup script 2 TTPs 13 IoCs

Boot or Logon Autostart Execution

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/root/.profile	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/root/.bash_profile	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/profile	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/profile.d/00-net.sh	Process not Found
File opened for modification	/etc/bash.bashrc	Process not Found
File opened for modification	/root/.bashrc	Process not Found
File opened for modification	/etc/bash.bashrc	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/profile.d/00-net.sh	network-dispatch
File opened for modification	/etc/profile.d/00-net.sh	network-dispatch
File opened for modification	/root/.profile	Process not Found
File opened for modification	/root/.bash_profile	Process not Found
File opened for modification	/etc/profile.d/00-net.sh	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	dbus-daemon	1466	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	[kthrotld/0]	1466	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	irqbalance	1467	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	[kworker/u:2]	1493	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	dhcpd	1466	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	[kblockd/1]	1466	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	docker	1495	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1500	systemctl
Changes the process name, possibly in an attempt to hide itself	php-fpm	1505	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kworker/1:0]	1505	network-dispatch
Changes the process name, possibly in an attempt to hide itself	ntpd	1506	network-dispatch
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1512	systemctl
Changes the process name, possibly in an attempt to hide itself	[ext4-rcvy]	1541	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1546	network-dispatch
Changes the process name, possibly in an attempt to hide itself	docker	1466	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	[kblockd/0]	1466	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	nginx	1549	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1554	systemctl
Changes the process name, possibly in an attempt to hide itself	ntpd	1505	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kblockd/0]	1505	network-dispatch
Changes the process name, possibly in an attempt to hide itself	irqbalance	1559	network-dispatch
Changes the process name, possibly in an attempt to hide itself	php-fpm	1562	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kblockd/0]	1562	network-dispatch
Changes the process name, possibly in an attempt to hide itself	atd	1563	network-dispatch
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1570	systemctl
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1577	systemctl
Changes the process name, possibly in an attempt to hide itself	ntpd	1583	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kworker/2:0]	1583	network-dispatch
Changes the process name, possibly in an attempt to hide itself	ntpd	1584	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	1633	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	[ext4-rcvy]	1640	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1642	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1646	network-dispatch
Changes the process name, possibly in an attempt to hide itself	irqbalance	1466	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	[kblockd/0]	1466	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	systemd	1649	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1655	systemctl
Changes the process name, possibly in an attempt to hide itself	docker	1660	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1660	network-dispatch
Changes the process name, possibly in an attempt to hide itself	php-fpm	1661	network-dispatch
Changes the process name, possibly in an attempt to hide itself	ntpd	1505	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kworker/1:1]	1505	network-dispatch
Changes the process name, possibly in an attempt to hide itself	systemd	1664	network-dispatch
Changes the process name, possibly in an attempt to hide itself	rsyslogd	1562	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	1562	network-dispatch
Changes the process name, possibly in an attempt to hide itself	php-fpm	1667	network-dispatch
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1715	systemctl
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1722	systemctl
Changes the process name, possibly in an attempt to hide itself	dhcpd	1726	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kworker/1:0]	1726	network-dispatch
Changes the process name, possibly in an attempt to hide itself	ntpd	1727	network-dispatch
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1733	systemctl
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	1810	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	[kthrotld/0]	1827	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kworker/2:0]	1829	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[kworker/u:2]	1831	network-dispatch
Changes the process name, possibly in an attempt to hide itself	[jbd2/dm0-8]	1838	Process not Found
Changes the process name, possibly in an attempt to hide itself	[jbd2/dm0-8]	1840	Process not Found
Changes the process name, possibly in an attempt to hide itself	[kblockd/1]	1842	Process not Found
Changes the process name, possibly in an attempt to hide itself	[kworker/2:0]	1848	network-dispatch
Changes the process name, possibly in an attempt to hide itself	systemd	1466	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	[kblockd/1]	1466	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	ntpd	1849	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1857	Process not Found

Creates a desktop entry file 3 TTPs 10 IoCs

A .desktop file is used by desktop environments to register and launch applications. This can be abused to gain persistence.

persistence execution

User Execution

T1204

Malicious File

T1204.002

XDG Autostart Entries

description	ioc	Process
File opened for modification	/etc/xdg/autostart/network-dispatch.desktop	network-dispatch
File opened for modification	/etc/xdg/autostart/network-dispatch.desktop	Process not Found
File opened for modification	/etc/xdg/autostart/network-dispatch.desktop	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/etc/xdg/autostart/network-dispatch.desktop	network-dispatch
File opened for modification	/etc/xdg/autostart/network-dispatch.desktop	network-dispatch
File opened for modification	/etc/xdg/autostart/network-dispatch.desktop	network-dispatch
File opened for modification	/etc/xdg/autostart/network-dispatch.desktop	network-dispatch
File opened for modification	/etc/xdg/autostart/network-dispatch.desktop	Process not Found
File opened for modification	/etc/xdg/autostart/network-dispatch.desktop	network-dispatch
File opened for modification	/etc/xdg/autostart/network-dispatch.desktop	Process not Found

Reads system network configuration 1 TTPs 56 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	network-dispatch
File opened for reading	/proc/net/unix	network-dispatch
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	network-dispatch
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	network-dispatch
File opened for reading	/proc/net/unix	network-dispatch
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	network-dispatch
File opened for reading	/proc/net/unix	network-dispatch
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	Process not Found
File opened for reading	/proc/net/unix	network-dispatch

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/897/fd	Process not Found
File opened for reading	/proc/30/fd	Process not Found
File opened for reading	/proc/404/fd	Process not Found
File opened for reading	/proc/3/fd	Process not Found
File opened for reading	/proc/35/fd	Process not Found
File opened for reading	/proc/404/fd	Process not Found
File opened for reading	/proc/900/fd	Process not Found
File opened for reading	/proc/171/fd	Process not Found
File opened for reading	/proc/89/fd	network-dispatch
File opened for reading	/proc/478/fd	Process not Found
File opened for reading	/proc/115/fd	Process not Found
File opened for reading	/proc/168/fd	Process not Found
File opened for reading	/proc/660/fd	Process not Found
File opened for reading	/proc/1176/fd	Process not Found
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1178/fd	Process not Found
File opened for reading	/proc/78/fd	Process not Found
File opened for reading	/proc/1/environ	Process not Found
File opened for reading	/proc/693/fd	Process not Found
File opened for reading	/proc/29/fd	Process not Found
File opened for reading	/proc/30/fd	Process not Found
File opened for reading	/proc/1435/fd	Process not Found
File opened for reading	/proc/175/fd	Process not Found
File opened for reading	/proc/9/fd	network-dispatch
File opened for reading	/proc/693/fd	Process not Found
File opened for reading	/proc/cmdline	Process not Found
File opened for reading	/proc/166/fd	Process not Found
File opened for reading	/proc/4/fd	Process not Found
File opened for reading	/proc/81/fd	network-dispatch
File opened for reading	/proc/11/fd	network-dispatch
File opened for reading	/proc/1007/fd	Process not Found
File opened for reading	/proc/1176/fd	Process not Found
File opened for reading	/proc/933/fd	Process not Found
File opened for reading	/proc/sys/kernel/osrelease	Process not Found
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/475/fd	Process not Found
File opened for reading	/proc/22/fd	network-dispatch
File opened for reading	/proc/719/fd	Process not Found
File opened for reading	/proc/78/fd	Process not Found
File opened for reading	/proc/456/fd	Process not Found
File opened for reading	/proc/168/fd	network-dispatch
File opened for reading	/proc/330/fd	Process not Found
File opened for reading	/proc/1085/fd	Process not Found
File opened for reading	/proc/2/fd	Process not Found
File opened for reading	/proc/172/fd	Process not Found
File opened for reading	/proc/1159/fd	Process not Found
File opened for reading	/proc/473/fd	Process not Found
File opened for reading	/proc/587/fd	Process not Found
File opened for reading	/proc/472/fd	Process not Found
File opened for reading	/proc/330/fd	Process not Found
File opened for reading	/proc/1054/fd	Process not Found
File opened for reading	/proc/25/comm	Process not Found
File opened for reading	/proc/1362/fd	Process not Found
File opened for reading	/proc/513/fd	Process not Found
File opened for reading	/proc/83/fd	network-dispatch
File opened for reading	/proc/10/fd	Process not Found
File opened for reading	/proc/976/fd	network-dispatch
File opened for reading	/proc/sys/kernel/osrelease	Process not Found
File opened for reading	/proc/1290/fd	Process not Found
File opened for reading	/proc/1315/fd	Process not Found
File opened for reading	/proc/456/fd	Process not Found
File opened for reading	/proc/667/fd	Process not Found
File opened for reading	/proc/170/fd	network-dispatch
File opened for reading	/proc/18/fd	Process not Found

Writes file to shm directory 20 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.network-dispatch	network-dispatch
File opened for modification	/dev/shm/.network-dispatch	Process not Found
File opened for modification	/run/shm/.network-dispatch	network-dispatch
File opened for modification	/run/shm/.network-dispatch	network-dispatch
File opened for modification	/run/shm/.network-dispatch	Process not Found
File opened for modification	/dev/shm/.network-dispatch	Process not Found
File opened for modification	/dev/shm/.network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/dev/shm/.network-dispatch	network-dispatch
File opened for modification	/run/shm/.network-dispatch	network-dispatch
File opened for modification	/dev/shm/.network-dispatch	Process not Found
File opened for modification	/run/shm/.network-dispatch	Process not Found
File opened for modification	/dev/shm/.network-dispatch	network-dispatch
File opened for modification	/run/shm/.network-dispatch	network-dispatch
File opened for modification	/dev/shm/.network-dispatch	network-dispatch
File opened for modification	/dev/shm/.network-dispatch	Process not Found
File opened for modification	/dev/shm/.network-dispatch	Process not Found
File opened for modification	/run/shm/.network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/dev/shm/.network-dispatch	network-dispatch
File opened for modification	/run/shm/.network-dispatch	network-dispatch
File opened for modification	/dev/shm/.network-dispatch	network-dispatch

Writes file to tmp directory 35 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.font-unix/.nd	Process not Found
File opened for modification	/tmp/.network-dispatch	network-dispatch
File opened for modification	/tmp/.network-dispatch	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/tmp/.ICE-unix/.nd	network-dispatch
File opened for modification	/tmp/.X11-unix/.nd	Process not Found
File opened for modification	/tmp/.X11-unix/.nd	network-dispatch
File opened for modification	/tmp/.network-dispatch	Process not Found
File opened for modification	/tmp/.ICE-unix/.nd	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/tmp/.X11-unix/.nd	network-dispatch
File opened for modification	/tmp/.network-dispatch	network-dispatch
File opened for modification	/tmp/.ICE-unix/.nd	Process not Found
File opened for modification	/tmp/.ICE-unix/.nd	network-dispatch
File opened for modification	/tmp/.network-dispatch	network-dispatch
File opened for modification	/tmp/.network-dispatch	network-dispatch
File opened for modification	/tmp/.ICE-unix/.nd	network-dispatch
File opened for modification	/tmp/.font-unix/.nd	network-dispatch
File opened for modification	/tmp/.font-unix/.nd	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/tmp/.X11-unix/.nd	network-dispatch
File opened for modification	/tmp/.ICE-unix/.nd	Process not Found
File opened for modification	/tmp/.network-dispatch	Process not Found
File opened for modification	/tmp/.font-unix/.nd	Process not Found
File opened for modification	/tmp/.X11-unix/.nd	network-dispatch
File opened for modification	/tmp/.font-unix/.nd	network-dispatch
File opened for modification	/tmp/.network-dispatch	network-dispatch
File opened for modification	/tmp/.network-dispatch	network-dispatch
File opened for modification	/tmp/.X11-unix/.nd	Process not Found
File opened for modification	/tmp/.network-dispatch	Process not Found
File opened for modification	/tmp/.network-dispatch	Process not Found
File opened for modification	/tmp/.network-dispatch	Process not Found
File opened for modification	/tmp/.X11-unix/.nd	8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
File opened for modification	/tmp/.font-unix/.nd	network-dispatch
File opened for modification	/tmp/.ICE-unix/.nd	network-dispatch
File opened for modification	/tmp/.font-unix/.nd	network-dispatch
File opened for modification	/tmp/.ICE-unix/.nd	network-dispatch
File opened for modification	/tmp/.network-dispatch	Process not Found

/tmp/8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
/tmp/8802132fdd867e39ab0dbd3c0a847cc2ccd460d0c395dd2d08853fcbf1d31c5a
1⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Traces itself
- Creates/modifies Cron job
- Creates/modifies environment variables
- Deletes log files
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Writes file to system bin folder
- Modifies Bash startup script
- Changes its process name
- Creates a desktop entry file
- Writes file to shm directory
- Writes file to tmp directory
PID:1465
- /usr/local/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1480
- /usr/local/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1480
- /usr/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1480
- /usr/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1480
- /sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1480
- /bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1480
- /usr/local/sbin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1481
- /usr/local/bin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1481
- /usr/sbin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1481
- /usr/bin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1481
- /sbin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1481
- /bin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1481
- /usr/local/sbin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1482
- /usr/local/bin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1482
- /usr/sbin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1482
- /usr/bin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1482
- /sbin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1482
- /bin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1482
- /usr/local/sbin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1483
- /usr/local/bin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1483
- /usr/sbin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1483
- /usr/bin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1483
- /sbin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1483
- /bin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1483
- /snap/bin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1483
- /usr/local/sbin/nvram
  nvram set "rc_service=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1484
- /usr/local/bin/nvram
  nvram set "rc_service=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1484
- /usr/sbin/nvram
  nvram set "rc_service=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1484
- /usr/bin/nvram
  nvram set "rc_service=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1484
- /sbin/nvram
  nvram set "rc_service=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1484
- /bin/nvram
  nvram set "rc_service=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1484
- /snap/bin/nvram
  nvram set "rc_service=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1484
- /usr/local/sbin/nvram
  nvram set "sys_startup=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1485
- /usr/local/bin/nvram
  nvram set "sys_startup=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1485
- /usr/sbin/nvram
  nvram set "sys_startup=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1485
- /usr/bin/nvram
  nvram set "sys_startup=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1485
- /sbin/nvram
  nvram set "sys_startup=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1485
- /bin/nvram
  nvram set "sys_startup=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1485
- /snap/bin/nvram
  nvram set "sys_startup=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1485
- /usr/local/sbin/nvram
  nvram set "custom_script=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1486
- /usr/local/bin/nvram
  nvram set "custom_script=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1486
- /usr/sbin/nvram
  nvram set "custom_script=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1486
- /usr/bin/nvram
  nvram set "custom_script=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1486
- /sbin/nvram
  nvram set "custom_script=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1486
- /bin/nvram
  nvram set "custom_script=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1486
- /snap/bin/nvram
  nvram set "custom_script=/usr/local/bin/network-dispatch &"
  2⤵
  PID:1486
- /usr/local/sbin/nvram
  nvram commit
  2⤵
  PID:1487
- /usr/local/bin/nvram
  nvram commit
  2⤵
  PID:1487
- /usr/sbin/nvram
  nvram commit
  2⤵
  PID:1487
- /usr/bin/nvram
  nvram commit
  2⤵
  PID:1487
- /sbin/nvram
  nvram commit
  2⤵
  PID:1487
- /bin/nvram
  nvram commit
  2⤵
  PID:1487
- /snap/bin/nvram
  nvram commit
  2⤵
  PID:1487
- /usr/local/sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1488
- /usr/local/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1488
- /usr/sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1488
- /usr/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1488
- /sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1488
- /bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1488
- /snap/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1488
- /usr/local/sbin/fw_setenv
  fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
  2⤵
  PID:1489
- /usr/local/bin/fw_setenv
  fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
  2⤵
  PID:1489
- /usr/sbin/fw_setenv
  fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
  2⤵
  PID:1489
- /usr/bin/fw_setenv
  fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
  2⤵
  PID:1489
- /sbin/fw_setenv
  fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
  2⤵
  PID:1489
- /bin/fw_setenv
  fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
  2⤵
  PID:1489
- /snap/bin/fw_setenv
  fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
  2⤵
  PID:1489
- /etc/init.d/network-dispatch
  /etc/init.d/network-dispatch enable
  2⤵
  PID:1490
- /usr/local/sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1491
- /usr/local/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1491
- /usr/sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1491
- /usr/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1491
- /sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1491
- /bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1491
- /snap/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1491
- /usr/local/bin/network-dispatch
  /usr/local/bin/network-dispatch
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Traces itself
  - Creates/modifies Cron job
  - Creates/modifies environment variables
  - Deletes log files
  - Modifies init.d
  - Modifies rc script
  - Modifies systemd
  - Write file to user bin folder
  - Writes file to system bin folder
  - Modifies Bash startup script
  - Changes its process name
  - Creates a desktop entry file
  - Reads system network configuration
  - Writes file to shm directory
  - Writes file to tmp directory
  PID:1494
- - /usr/local/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1511
- - /usr/local/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1511
- - /usr/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1511
- - /usr/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1511
- - /sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1511
- - /bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    - Changes its process name
    PID:1511
  - - /lib/systemd/systemd-sysv-install
      /lib/systemd/systemd-sysv-install enable network-dispatch
      4⤵
      PID:1512
    - - /usr/bin/getopt
        
        getopt -o r: --long root: -- enable network-dispatch
        5⤵
        
        PID:1513
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d network-dispatch defaults
        5⤵
        
        PID:1514
      - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1515
      - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1515
      - /usr/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1515
      - /usr/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1515
      - /sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1515
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1515
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d network-dispatch enable
        5⤵
        
        PID:1516
      - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1517
      - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1517
      - /usr/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1517
      - /usr/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1517
      - /sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1517
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1517
- - /usr/local/sbin/systemctl
    systemctl enable network-dispatch.timer
    3⤵
    PID:1519
- - /usr/local/bin/systemctl
    systemctl enable network-dispatch.timer
    3⤵
    PID:1519
- - /usr/sbin/systemctl
    systemctl enable network-dispatch.timer
    3⤵
    PID:1519
- - /usr/bin/systemctl
    systemctl enable network-dispatch.timer
    3⤵
    PID:1519
- - /sbin/systemctl
    systemctl enable network-dispatch.timer
    3⤵
    PID:1519
- - /bin/systemctl
    systemctl enable network-dispatch.timer
    3⤵
    PID:1519
- - /usr/local/sbin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1521
- - /usr/local/bin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1521
- - /usr/sbin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1521
- - /usr/bin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1521
- - /sbin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1521
- - /bin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1521
- - /usr/local/sbin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1523
- - /usr/local/bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1523
- - /usr/sbin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1523
- - /usr/bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1523
- - /sbin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1523
- - /bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1523
- - /snap/bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1523
- - /usr/local/sbin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1525
- - /usr/local/bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1525
- - /usr/sbin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1525
- - /usr/bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1525
- - /sbin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1525
- - /bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1525
- - /snap/bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1525
- - /usr/local/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1527
- - /usr/local/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1527
- - /usr/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1527
- - /usr/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1527
- - /sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1527
- - /bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1527
- - /snap/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1527
- - /usr/local/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1529
- - /usr/local/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1529
- - /usr/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1529
- - /usr/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1529
- - /sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1529
- - /bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1529
- - /snap/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1529
- - /usr/local/sbin/nvram
    nvram commit
    3⤵
    PID:1532
- - /usr/local/bin/nvram
    nvram commit
    3⤵
    PID:1532
- - /usr/sbin/nvram
    nvram commit
    3⤵
    PID:1532
- - /usr/bin/nvram
    nvram commit
    3⤵
    PID:1532
- - /sbin/nvram
    nvram commit
    3⤵
    PID:1532
- - /bin/nvram
    nvram commit
    3⤵
    PID:1532
- - /snap/bin/nvram
    nvram commit
    3⤵
    PID:1532
- - /usr/local/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1534
- - /usr/local/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1534
- - /usr/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1534
- - /usr/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1534
- - /sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1534
- - /bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1534
- - /snap/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1534
- - /usr/local/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1535
- - /usr/local/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1535
- - /usr/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1535
- - /usr/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1535
- - /sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1535
- - /bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1535
- - /snap/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1535
- - /etc/init.d/network-dispatch
    /etc/init.d/network-dispatch enable
    3⤵
    PID:1537
- - /usr/local/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1542
- - /usr/local/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1542
- - /usr/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1542
- - /usr/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1542
- - /sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1542
- - /bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1542
- - /snap/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1542
- - /usr/local/bin/network-dispatch
    /usr/local/bin/network-dispatch
    3⤵
    - Executes dropped EXE
    - Modifies Watchdog functionality
    - Traces itself
    - Creates/modifies Cron job
    - Creates/modifies environment variables
    - Deletes log files
    - Modifies init.d
    - Modifies systemd
    - Write file to user bin folder
    - Writes file to system bin folder
    - Modifies Bash startup script
    - Changes its process name
    - Creates a desktop entry file
    - Reads system network configuration
    - Reads runtime system information
    - Writes file to shm directory
    - Writes file to tmp directory
    PID:1548
  - - /usr/local/sbin/systemctl
      systemctl enable network-dispatch.timer
      4⤵
      PID:1602
  - - /usr/local/bin/systemctl
      systemctl enable network-dispatch.timer
      4⤵
      PID:1602
  - - /usr/sbin/systemctl
      systemctl enable network-dispatch.timer
      4⤵
      PID:1602
  - - /usr/bin/systemctl
      systemctl enable network-dispatch.timer
      4⤵
      PID:1602
  - - /sbin/systemctl
      systemctl enable network-dispatch.timer
      4⤵
      PID:1602
  - - /bin/systemctl
      systemctl enable network-dispatch.timer
      4⤵
      PID:1602
  - - /usr/local/sbin/systemctl
      systemctl enable network-dispatch.path
      4⤵
      PID:1606
  - - /usr/local/bin/systemctl
      systemctl enable network-dispatch.path
      4⤵
      PID:1606
  - - /usr/sbin/systemctl
      systemctl enable network-dispatch.path
      4⤵
      PID:1606
  - - /usr/bin/systemctl
      systemctl enable network-dispatch.path
      4⤵
      PID:1606
  - - /sbin/systemctl
      systemctl enable network-dispatch.path
      4⤵
      PID:1606
  - - /bin/systemctl
      systemctl enable network-dispatch.path
      4⤵
      PID:1606
  - - /usr/local/sbin/nvram
      nvram set "rc_startup=/etc/init.d/network-dispatch start"
      4⤵
      PID:1610
  - - /usr/local/bin/nvram
      nvram set "rc_startup=/etc/init.d/network-dispatch start"
      4⤵
      PID:1610
  - - /usr/sbin/nvram
      nvram set "rc_startup=/etc/init.d/network-dispatch start"
      4⤵
      PID:1610
  - - /usr/bin/nvram
      nvram set "rc_startup=/etc/init.d/network-dispatch start"
      4⤵
      PID:1610
  - - /sbin/nvram
      nvram set "rc_startup=/etc/init.d/network-dispatch start"
      4⤵
      PID:1610
  - - /bin/nvram
      nvram set "rc_startup=/etc/init.d/network-dispatch start"
      4⤵
      PID:1610
  - - /snap/bin/nvram
      nvram set "rc_startup=/etc/init.d/network-dispatch start"
      4⤵
      PID:1610
  - - /usr/local/sbin/nvram
      nvram set "rc_service=/usr/bin/.network-dispatch &"
      4⤵
      PID:1614
  - - /usr/local/bin/nvram
      nvram set "rc_service=/usr/bin/.network-dispatch &"
      4⤵
      PID:1614
  - - /usr/sbin/nvram
      nvram set "rc_service=/usr/bin/.network-dispatch &"
      4⤵
      PID:1614
  - - /usr/bin/nvram
      nvram set "rc_service=/usr/bin/.network-dispatch &"
      4⤵
      PID:1614
  - - /sbin/nvram
      nvram set "rc_service=/usr/bin/.network-dispatch &"
      4⤵
      PID:1614
  - - /bin/nvram
      nvram set "rc_service=/usr/bin/.network-dispatch &"
      4⤵
      PID:1614
  - - /snap/bin/nvram
      nvram set "rc_service=/usr/bin/.network-dispatch &"
      4⤵
      PID:1614
  - - /usr/local/sbin/nvram
      nvram set "sys_startup=/usr/bin/.network-dispatch &"
      4⤵
      PID:1619
  - - /usr/local/bin/nvram
      nvram set "sys_startup=/usr/bin/.network-dispatch &"
      4⤵
      PID:1619
  - - /usr/sbin/nvram
      nvram set "sys_startup=/usr/bin/.network-dispatch &"
      4⤵
      PID:1619
  - - /usr/bin/nvram
      nvram set "sys_startup=/usr/bin/.network-dispatch &"
      4⤵
      PID:1619
  - - /sbin/nvram
      nvram set "sys_startup=/usr/bin/.network-dispatch &"
      4⤵
      PID:1619
  - - /bin/nvram
      nvram set "sys_startup=/usr/bin/.network-dispatch &"
      4⤵
      PID:1619
  - - /snap/bin/nvram
      nvram set "sys_startup=/usr/bin/.network-dispatch &"
      4⤵
      PID:1619
  - - /usr/local/sbin/nvram
      nvram set "custom_script=/usr/bin/.network-dispatch &"
      4⤵
      PID:1623
  - - /usr/local/bin/nvram
      nvram set "custom_script=/usr/bin/.network-dispatch &"
      4⤵
      PID:1623
  - - /usr/sbin/nvram
      nvram set "custom_script=/usr/bin/.network-dispatch &"
      4⤵
      PID:1623
  - - /usr/bin/nvram
      nvram set "custom_script=/usr/bin/.network-dispatch &"
      4⤵
      PID:1623
  - - /sbin/nvram
      nvram set "custom_script=/usr/bin/.network-dispatch &"
      4⤵
      PID:1623
  - - /bin/nvram
      nvram set "custom_script=/usr/bin/.network-dispatch &"
      4⤵
      PID:1623
  - - /snap/bin/nvram
      nvram set "custom_script=/usr/bin/.network-dispatch &"
      4⤵
      PID:1623
  - - /usr/local/sbin/nvram
      nvram commit
      4⤵
      PID:1629
  - - /usr/local/bin/nvram
      nvram commit
      4⤵
      PID:1629
  - - /usr/sbin/nvram
      nvram commit
      4⤵
      PID:1629
  - - /usr/bin/nvram
      nvram commit
      4⤵
      PID:1629
  - - /sbin/nvram
      nvram commit
      4⤵
      PID:1629
  - - /bin/nvram
      nvram commit
      4⤵
      PID:1629
  - - /snap/bin/nvram
      nvram commit
      4⤵
      PID:1629
  - - /usr/local/sbin/fw_printenv
      fw_printenv bootcmd
      4⤵
      PID:1634
  - - /usr/local/bin/fw_printenv
      fw_printenv bootcmd
      4⤵
      PID:1634
  - - /usr/sbin/fw_printenv
      fw_printenv bootcmd
      4⤵
      PID:1634
  - - /usr/bin/fw_printenv
      fw_printenv bootcmd
      4⤵
      PID:1634
  - - /sbin/fw_printenv
      fw_printenv bootcmd
      4⤵
      PID:1634
  - - /bin/fw_printenv
      fw_printenv bootcmd
      4⤵
      PID:1634
  - - /snap/bin/fw_printenv
      fw_printenv bootcmd
      4⤵
      PID:1634
  - - /usr/local/sbin/fw_setenv
      fw_setenv preboot "sh /usr/bin/.network-dispatch &"
      4⤵
      PID:1635
  - - /usr/local/bin/fw_setenv
      fw_setenv preboot "sh /usr/bin/.network-dispatch &"
      4⤵
      PID:1635
  - - /usr/sbin/fw_setenv
      fw_setenv preboot "sh /usr/bin/.network-dispatch &"
      4⤵
      PID:1635
  - - /usr/bin/fw_setenv
      fw_setenv preboot "sh /usr/bin/.network-dispatch &"
      4⤵
      PID:1635
  - - /sbin/fw_setenv
      fw_setenv preboot "sh /usr/bin/.network-dispatch &"
      4⤵
      PID:1635
  - - /bin/fw_setenv
      fw_setenv preboot "sh /usr/bin/.network-dispatch &"
      4⤵
      PID:1635
  - - /snap/bin/fw_setenv
      fw_setenv preboot "sh /usr/bin/.network-dispatch &"
      4⤵
      PID:1635
  - - /etc/init.d/network-dispatch
      /etc/init.d/network-dispatch enable
      4⤵
      PID:1638
  - - /usr/local/sbin/rc-update
      rc-update add network-dispatch
      4⤵
      PID:1644
  - - /usr/local/bin/rc-update
      rc-update add network-dispatch
      4⤵
      PID:1644
  - - /usr/sbin/rc-update
      rc-update add network-dispatch
      4⤵
      PID:1644
  - - /usr/bin/rc-update
      rc-update add network-dispatch
      4⤵
      PID:1644
  - - /sbin/rc-update
      rc-update add network-dispatch
      4⤵
      PID:1644
  - - /bin/rc-update
      rc-update add network-dispatch
      4⤵
      PID:1644
  - - /snap/bin/rc-update
      rc-update add network-dispatch
      4⤵
      PID:1644
  - - /usr/local/bin/network-dispatch
      /usr/local/bin/network-dispatch
      4⤵
      Executes dropped EXE
      Modifies Watchdog functionality
      Traces itself
      Creates/modifies Cron job
      Deletes log files
      Modifies init.d
      Modifies systemd
      Write file to user bin folder
      Writes file to system bin folder
      Changes its process name
      Creates a desktop entry file
      Reads system network configuration
      Reads runtime system information
      Writes file to shm directory
      Writes file to tmp directory
      PID:1652
    - - /usr/local/sbin/systemctl
        
        systemctl enable network-dispatch.path
        5⤵
        
        PID:1769
    - - /usr/local/bin/systemctl
        
        systemctl enable network-dispatch.path
        5⤵
        
        PID:1769
    - - /usr/sbin/systemctl
        
        systemctl enable network-dispatch.path
        5⤵
        
        PID:1769
    - - /usr/bin/systemctl
        
        systemctl enable network-dispatch.path
        5⤵
        
        PID:1769
    - - /sbin/systemctl
        
        systemctl enable network-dispatch.path
        5⤵
        
        PID:1769
    - - /bin/systemctl
        
        systemctl enable network-dispatch.path
        5⤵
        
        PID:1769
    - - /usr/local/sbin/nvram
        
        nvram set "rc_startup=/etc/init.d/network-dispatch start"
        5⤵
        
        PID:1777
    - - /usr/local/bin/nvram
        
        nvram set "rc_startup=/etc/init.d/network-dispatch start"
        5⤵
        
        PID:1777
    - - /usr/sbin/nvram
        
        nvram set "rc_startup=/etc/init.d/network-dispatch start"
        5⤵
        
        PID:1777
    - - /usr/bin/nvram
        
        nvram set "rc_startup=/etc/init.d/network-dispatch start"
        5⤵
        
        PID:1777
    - - /sbin/nvram
        
        nvram set "rc_startup=/etc/init.d/network-dispatch start"
        5⤵
        
        PID:1777
    - - /bin/nvram
        
        nvram set "rc_startup=/etc/init.d/network-dispatch start"
        5⤵
        
        PID:1777
    - - /snap/bin/nvram
        
        nvram set "rc_startup=/etc/init.d/network-dispatch start"
        5⤵
        
        PID:1777
    - - /usr/local/sbin/nvram
        
        nvram set "rc_service=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1786
    - - /usr/local/bin/nvram
        
        nvram set "rc_service=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1786
    - - /usr/sbin/nvram
        
        nvram set "rc_service=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1786
    - - /usr/bin/nvram
        
        nvram set "rc_service=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1786
    - - /sbin/nvram
        
        nvram set "rc_service=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1786
    - - /bin/nvram
        
        nvram set "rc_service=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1786
    - - /snap/bin/nvram
        
        nvram set "rc_service=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1786
    - - /usr/local/sbin/nvram
        
        nvram set "sys_startup=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1794
    - - /usr/local/bin/nvram
        
        nvram set "sys_startup=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1794
    - - /usr/sbin/nvram
        
        nvram set "sys_startup=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1794
    - - /usr/bin/nvram
        
        nvram set "sys_startup=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1794
    - - /sbin/nvram
        
        nvram set "sys_startup=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1794
    - - /bin/nvram
        
        nvram set "sys_startup=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1794
    - - /snap/bin/nvram
        
        nvram set "sys_startup=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1794
    - - /usr/local/sbin/nvram
        
        nvram set "custom_script=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1805
    - - /usr/local/bin/nvram
        
        nvram set "custom_script=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1805
    - - /usr/sbin/nvram
        
        nvram set "custom_script=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1805
    - - /usr/bin/nvram
        
        nvram set "custom_script=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1805
    - - /sbin/nvram
        
        nvram set "custom_script=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1805
    - - /bin/nvram
        
        nvram set "custom_script=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1805
    - - /snap/bin/nvram
        
        nvram set "custom_script=/usr/bin/.network-dispatch &"
        5⤵
        
        PID:1805
    - - /usr/local/sbin/nvram
        
        nvram commit
        5⤵
        
        PID:1817
    - - /usr/local/bin/nvram
        
        nvram commit
        5⤵
        
        PID:1817
    - - /usr/sbin/nvram
        
        nvram commit
        5⤵
        
        PID:1817
    - - /usr/bin/nvram
        
        nvram commit
        5⤵
        
        PID:1817
    - - /sbin/nvram
        
        nvram commit
        5⤵
        
        PID:1817
    - - /bin/nvram
        
        nvram commit
        5⤵
        
        PID:1817
    - - /snap/bin/nvram
        
        nvram commit
        5⤵
        
        PID:1817
    - - /usr/local/sbin/fw_printenv
        
        fw_printenv bootcmd
        5⤵
        
        PID:1824
    - - /usr/local/bin/fw_printenv
        
        fw_printenv bootcmd
        5⤵
        
        PID:1824
    - - /usr/sbin/fw_printenv
        
        fw_printenv bootcmd
        5⤵
        
        PID:1824
    - - /usr/bin/fw_printenv
        
        fw_printenv bootcmd
        5⤵
        
        PID:1824
    - - /sbin/fw_printenv
        
        fw_printenv bootcmd
        5⤵
        
        PID:1824
    - - /bin/fw_printenv
        
        fw_printenv bootcmd
        5⤵
        
        PID:1824
    - - /snap/bin/fw_printenv
        
        fw_printenv bootcmd
        5⤵
        
        PID:1824
    - - /usr/local/sbin/fw_setenv
        
        fw_setenv preboot "sh /usr/bin/.network-dispatch &"
        5⤵
        
        PID:1825
    - - /usr/local/bin/fw_setenv
        
        fw_setenv preboot "sh /usr/bin/.network-dispatch &"
        5⤵
        
        PID:1825
    - - /usr/sbin/fw_setenv
        
        fw_setenv preboot "sh /usr/bin/.network-dispatch &"
        5⤵
        
        PID:1825
    - - /usr/bin/fw_setenv
        
        fw_setenv preboot "sh /usr/bin/.network-dispatch &"
        5⤵
        
        PID:1825
    - - /sbin/fw_setenv
        
        fw_setenv preboot "sh /usr/bin/.network-dispatch &"
        5⤵
        
        PID:1825
    - - /bin/fw_setenv
        
        fw_setenv preboot "sh /usr/bin/.network-dispatch &"
        5⤵
        
        PID:1825
    - - /snap/bin/fw_setenv
        
        fw_setenv preboot "sh /usr/bin/.network-dispatch &"
        5⤵
        
        PID:1825
- - /usr/local/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1569
- - /usr/local/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1569
- - /usr/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1569
- - /usr/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1569
- - /sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1569
- - /bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    - Changes its process name
    PID:1569
  - - /lib/systemd/systemd-sysv-install
      /lib/systemd/systemd-sysv-install enable network-dispatch
      4⤵
      PID:1570
    - - /usr/bin/getopt
        
        getopt -o r: --long root: -- enable network-dispatch
        5⤵
        
        PID:1571
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d network-dispatch defaults
        5⤵
        
        PID:1572
      - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1573
      - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1573
      - /usr/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1573
      - /usr/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1573
      - /sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1573
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1573
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d network-dispatch enable
        5⤵
        
        PID:1574
      - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1575
      - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1575
      - /usr/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1575
      - /usr/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1575
      - /sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1575
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1575
- - /usr/local/sbin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1599
- - /usr/local/bin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1599
- - /usr/sbin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1599
- - /usr/bin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1599
- - /sbin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1599
- - /bin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1599
- - /usr/local/sbin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1603
- - /usr/local/bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1603
- - /usr/sbin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1603
- - /usr/bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1603
- - /sbin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1603
- - /bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1603
- - /snap/bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1603
- - /usr/local/sbin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1607
- - /usr/local/bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1607
- - /usr/sbin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1607
- - /usr/bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1607
- - /sbin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1607
- - /bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1607
- - /snap/bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1607
- - /usr/local/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1611
- - /usr/local/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1611
- - /usr/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1611
- - /usr/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1611
- - /sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1611
- - /bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1611
- - /snap/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1611
- - /usr/local/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1615
- - /usr/local/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1615
- - /usr/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1615
- - /usr/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1615
- - /sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1615
- - /bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1615
- - /snap/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1615
- - /usr/local/sbin/nvram
    nvram commit
    3⤵
    PID:1620
- - /usr/local/bin/nvram
    nvram commit
    3⤵
    PID:1620
- - /usr/sbin/nvram
    nvram commit
    3⤵
    PID:1620
- - /usr/bin/nvram
    nvram commit
    3⤵
    PID:1620
- - /sbin/nvram
    nvram commit
    3⤵
    PID:1620
- - /bin/nvram
    nvram commit
    3⤵
    PID:1620
- - /snap/bin/nvram
    nvram commit
    3⤵
    PID:1620
- - /usr/local/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1624
- - /usr/local/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1624
- - /usr/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1624
- - /usr/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1624
- - /sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1624
- - /bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1624
- - /snap/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1624
- - /usr/local/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1625
- - /usr/local/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1625
- - /usr/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1625
- - /usr/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1625
- - /sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1625
- - /bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1625
- - /snap/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1625
- - /etc/init.d/network-dispatch
    /etc/init.d/network-dispatch enable
    3⤵
    PID:1630
- - /usr/local/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1636
- - /usr/local/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1636
- - /usr/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1636
- - /usr/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1636
- - /sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1636
- - /bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1636
- - /snap/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1636
- - /usr/local/bin/network-dispatch
    /usr/local/bin/network-dispatch
    3⤵
    - Traces itself
    - Reads system network configuration
    - Reads runtime system information
    PID:1647
- - /usr/local/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1771
- - /usr/local/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1771
- - /usr/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1771
- - /usr/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1771
- - /sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1771
- - /bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1771
- - /snap/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1771
- - /usr/local/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1779
- - /usr/local/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1779
- - /usr/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1779
- - /usr/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1779
- - /sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1779
- - /bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1779
- - /snap/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1779
- - /usr/local/sbin/nvram
    nvram commit
    3⤵
    PID:1788
- - /usr/local/bin/nvram
    nvram commit
    3⤵
    PID:1788
- - /usr/sbin/nvram
    nvram commit
    3⤵
    PID:1788
- - /usr/bin/nvram
    nvram commit
    3⤵
    PID:1788
- - /sbin/nvram
    nvram commit
    3⤵
    PID:1788
- - /bin/nvram
    nvram commit
    3⤵
    PID:1788
- - /snap/bin/nvram
    nvram commit
    3⤵
    PID:1788
- - /usr/local/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1797
- - /usr/local/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1797
- - /usr/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1797
- - /usr/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1797
- - /sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1797
- - /bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1797
- - /snap/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1797
- - /usr/local/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1798
- - /usr/local/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1798
- - /usr/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1798
- - /usr/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1798
- - /sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1798
- - /bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1798
- - /snap/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1798
- - /etc/init.d/network-dispatch
    /etc/init.d/network-dispatch enable
    3⤵
    PID:1807
- - /usr/local/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1819
- - /usr/local/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1819
- - /usr/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1819
- - /usr/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1819
- - /sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1819
- - /bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1819
- - /snap/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1819
- /usr/local/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1499
- /usr/local/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1499
- /usr/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1499
- /usr/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1499
- /sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1499
- /bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  - Changes its process name
  PID:1499
- - /lib/systemd/systemd-sysv-install
    /lib/systemd/systemd-sysv-install enable network-dispatch
    3⤵
    PID:1500
  - - /usr/bin/getopt
      getopt -o r: --long root: -- enable network-dispatch
      4⤵
      PID:1501
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d network-dispatch defaults
      4⤵
      PID:1502
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1503
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1503
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1503
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1503
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1503
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1503
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d network-dispatch enable
      4⤵
      PID:1504
- /usr/local/sbin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1510
- /usr/local/bin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1510
- /usr/sbin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1510
- /usr/bin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1510
- /sbin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1510
- /bin/systemctl
  systemctl enable network-dispatch.timer
  2⤵
  PID:1510
- /usr/local/sbin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1518
- /usr/local/bin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1518
- /usr/sbin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1518
- /usr/bin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1518
- /sbin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1518
- /bin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1518
- /usr/local/sbin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1520
- /usr/local/bin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1520
- /usr/sbin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1520
- /usr/bin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1520
- /sbin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1520
- /bin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1520
- /snap/bin/nvram
  nvram set "rc_startup=/etc/init.d/network-dispatch start"
  2⤵
  PID:1520
- /usr/local/sbin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1522
- /usr/local/bin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1522
- /usr/sbin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1522
- /usr/bin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1522
- /sbin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1522
- /bin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1522
- /snap/bin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1522
- /usr/local/sbin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1524
- /usr/local/bin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1524
- /usr/sbin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1524
- /usr/bin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1524
- /sbin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1524
- /bin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1524
- /snap/bin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1524
- /usr/local/sbin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1526
- /usr/local/bin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1526
- /usr/sbin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1526
- /usr/bin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1526
- /sbin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1526
- /bin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1526
- /snap/bin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1526
- /usr/local/sbin/nvram
  nvram commit
  2⤵
  PID:1528
- /usr/local/bin/nvram
  nvram commit
  2⤵
  PID:1528
- /usr/sbin/nvram
  nvram commit
  2⤵
  PID:1528
- /usr/bin/nvram
  nvram commit
  2⤵
  PID:1528
- /sbin/nvram
  nvram commit
  2⤵
  PID:1528
- /bin/nvram
  nvram commit
  2⤵
  PID:1528
- /snap/bin/nvram
  nvram commit
  2⤵
  PID:1528
- /usr/local/sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1530
- /usr/local/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1530
- /usr/sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1530
- /usr/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1530
- /sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1530
- /bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1530
- /snap/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1530
- /usr/local/sbin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1531
- /usr/local/bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1531
- /usr/sbin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1531
- /usr/bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1531
- /sbin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1531
- /bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1531
- /snap/bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1531
- /etc/init.d/network-dispatch
  /etc/init.d/network-dispatch enable
  2⤵
  PID:1533
- /usr/local/sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1536
- /usr/local/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1536
- /usr/sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1536
- /usr/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1536
- /sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1536
- /bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1536
- /snap/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1536
- /usr/local/bin/network-dispatch
  /usr/local/bin/network-dispatch
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Traces itself
  - Creates/modifies Cron job
  - Deletes log files
  - Modifies init.d
  - Modifies systemd
  - Write file to user bin folder
  - Writes file to system bin folder
  - Changes its process name
  - Creates a desktop entry file
  - Reads system network configuration
  - Reads runtime system information
  - Writes file to shm directory
  - Writes file to tmp directory
  PID:1547
- - /usr/local/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1576
- - /usr/local/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1576
- - /usr/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1576
- - /usr/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1576
- - /sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1576
- - /bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    - Changes its process name
    PID:1576
  - - /lib/systemd/systemd-sysv-install
      /lib/systemd/systemd-sysv-install enable network-dispatch
      4⤵
      PID:1577
    - - /usr/bin/getopt
        
        getopt -o r: --long root: -- enable network-dispatch
        5⤵
        
        PID:1578
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d network-dispatch defaults
        5⤵
        
        PID:1579
      - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1580
      - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1580
      - /usr/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1580
      - /usr/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1580
      - /sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1580
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1580
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d network-dispatch enable
        5⤵
        
        PID:1581
      - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1582
      - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1582
      - /usr/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1582
      - /usr/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1582
      - /sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1582
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1582
- - /usr/local/sbin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1600
- - /usr/local/bin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1600
- - /usr/sbin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1600
- - /usr/bin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1600
- - /sbin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1600
- - /bin/systemctl
    systemctl enable network-dispatch.path
    3⤵
    PID:1600
- - /usr/local/sbin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1604
- - /usr/local/bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1604
- - /usr/sbin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1604
- - /usr/bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1604
- - /sbin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1604
- - /bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1604
- - /snap/bin/nvram
    nvram set "rc_startup=/etc/init.d/network-dispatch start"
    3⤵
    PID:1604
- - /usr/local/sbin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1608
- - /usr/local/bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1608
- - /usr/sbin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1608
- - /usr/bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1608
- - /sbin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1608
- - /bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1608
- - /snap/bin/nvram
    nvram set "rc_service=/usr/bin/.network-dispatch &"
    3⤵
    PID:1608
- - /usr/local/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1612
- - /usr/local/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1612
- - /usr/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1612
- - /usr/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1612
- - /sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1612
- - /bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1612
- - /snap/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1612
- - /usr/local/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1616
- - /usr/local/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1616
- - /usr/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1616
- - /usr/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1616
- - /sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1616
- - /bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1616
- - /snap/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1616
- - /usr/local/sbin/nvram
    nvram commit
    3⤵
    PID:1621
- - /usr/local/bin/nvram
    nvram commit
    3⤵
    PID:1621
- - /usr/sbin/nvram
    nvram commit
    3⤵
    PID:1621
- - /usr/bin/nvram
    nvram commit
    3⤵
    PID:1621
- - /sbin/nvram
    nvram commit
    3⤵
    PID:1621
- - /bin/nvram
    nvram commit
    3⤵
    PID:1621
- - /snap/bin/nvram
    nvram commit
    3⤵
    PID:1621
- - /usr/local/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1626
- - /usr/local/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1626
- - /usr/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1626
- - /usr/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1626
- - /sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1626
- - /bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1626
- - /snap/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1626
- - /usr/local/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1627
- - /usr/local/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1627
- - /usr/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1627
- - /usr/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1627
- - /sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1627
- - /bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1627
- - /snap/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1627
- - /etc/init.d/network-dispatch
    /etc/init.d/network-dispatch enable
    3⤵
    PID:1631
- - /usr/local/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1637
- - /usr/local/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1637
- - /usr/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1637
- - /usr/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1637
- - /sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1637
- - /bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1637
- - /snap/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1637
- - /usr/local/bin/network-dispatch
    /usr/local/bin/network-dispatch
    3⤵
    - Traces itself
    - Reads system network configuration
    - Reads runtime system information
    PID:1648
- - /usr/local/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1772
- - /usr/local/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1772
- - /usr/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1772
- - /usr/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1772
- - /sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1772
- - /bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1772
- - /snap/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1772
- - /usr/local/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1780
- - /usr/local/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1780
- - /usr/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1780
- - /usr/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1780
- - /sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1780
- - /bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1780
- - /snap/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1780
- - /usr/local/sbin/nvram
    nvram commit
    3⤵
    PID:1789
- - /usr/local/bin/nvram
    nvram commit
    3⤵
    PID:1789
- - /usr/sbin/nvram
    nvram commit
    3⤵
    PID:1789
- - /usr/bin/nvram
    nvram commit
    3⤵
    PID:1789
- - /sbin/nvram
    nvram commit
    3⤵
    PID:1789
- - /bin/nvram
    nvram commit
    3⤵
    PID:1789
- - /snap/bin/nvram
    nvram commit
    3⤵
    PID:1789
- - /usr/local/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1799
- - /usr/local/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1799
- - /usr/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1799
- - /usr/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1799
- - /sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1799
- - /bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1799
- - /snap/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1799
- - /usr/local/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1800
- - /usr/local/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1800
- - /usr/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1800
- - /usr/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1800
- - /sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1800
- - /bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1800
- - /snap/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1800
- - /etc/init.d/network-dispatch
    /etc/init.d/network-dispatch enable
    3⤵
    PID:1808
- - /usr/local/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1820
- - /usr/local/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1820
- - /usr/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1820
- - /usr/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1820
- - /sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1820
- - /bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1820
- - /snap/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1820
- /usr/local/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1552
- /usr/local/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1552
- /usr/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1552
- /usr/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1552
- /sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1552
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1552
- /usr/local/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1553
- /usr/local/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1553
- /usr/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1553
- /usr/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1553
- /sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1553
- /bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  - Changes its process name
  PID:1553
- - /lib/systemd/systemd-sysv-install
    /lib/systemd/systemd-sysv-install enable network-dispatch
    3⤵
    PID:1554
  - - /usr/bin/getopt
      getopt -o r: --long root: -- enable network-dispatch
      4⤵
      PID:1555
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d network-dispatch defaults
      4⤵
      PID:1556
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1557
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1557
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1557
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1557
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1557
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1557
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d network-dispatch enable
      4⤵
      PID:1558
- /usr/local/sbin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1587
- /usr/local/bin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1587
- /usr/sbin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1587
- /usr/bin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1587
- /sbin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1587
- /bin/systemctl
  systemctl enable network-dispatch.path
  2⤵
  PID:1587
- /usr/local/sbin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1601
- /usr/local/bin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1601
- /usr/sbin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1601
- /usr/bin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1601
- /sbin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1601
- /bin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1601
- /snap/bin/nvram
  nvram set "rc_service=/usr/bin/.network-dispatch &"
  2⤵
  PID:1601
- /usr/local/sbin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1605
- /usr/local/bin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1605
- /usr/sbin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1605
- /usr/bin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1605
- /sbin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1605
- /bin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1605
- /snap/bin/nvram
  nvram set "sys_startup=/usr/bin/.network-dispatch &"
  2⤵
  PID:1605
- /usr/local/sbin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1609
- /usr/local/bin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1609
- /usr/sbin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1609
- /usr/bin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1609
- /sbin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1609
- /bin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1609
- /snap/bin/nvram
  nvram set "custom_script=/usr/bin/.network-dispatch &"
  2⤵
  PID:1609
- /usr/local/sbin/nvram
  nvram commit
  2⤵
  PID:1613
- /usr/local/bin/nvram
  nvram commit
  2⤵
  PID:1613
- /usr/sbin/nvram
  nvram commit
  2⤵
  PID:1613
- /usr/bin/nvram
  nvram commit
  2⤵
  PID:1613
- /sbin/nvram
  nvram commit
  2⤵
  PID:1613
- /bin/nvram
  nvram commit
  2⤵
  PID:1613
- /snap/bin/nvram
  nvram commit
  2⤵
  PID:1613
- /usr/local/sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1617
- /usr/local/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1617
- /usr/sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1617
- /usr/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1617
- /sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1617
- /bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1617
- /snap/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1617
- /usr/local/sbin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1618
- /usr/local/bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1618
- /usr/sbin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1618
- /usr/bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1618
- /sbin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1618
- /bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1618
- /snap/bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1618
- /etc/init.d/network-dispatch
  /etc/init.d/network-dispatch enable
  2⤵
  PID:1622
- /usr/local/sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1628
- /usr/local/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1628
- /usr/sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1628
- /usr/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1628
- /sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1628
- /bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1628
- /snap/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1628
- /usr/local/bin/network-dispatch
  /usr/local/bin/network-dispatch
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Traces itself
  - Creates/modifies Cron job
  - Deletes log files
  - Modifies init.d
  - Modifies systemd
  - Write file to user bin folder
  - Writes file to system bin folder
  - Changes its process name
  - Creates a desktop entry file
  - Reads system network configuration
  - Reads runtime system information
  - Writes file to shm directory
  - Writes file to tmp directory
  PID:1643
- - /usr/local/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1770
- - /usr/local/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1770
- - /usr/sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1770
- - /usr/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1770
- - /sbin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1770
- - /bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1770
- - /snap/bin/nvram
    nvram set "sys_startup=/usr/bin/.network-dispatch &"
    3⤵
    PID:1770
- - /usr/local/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1778
- - /usr/local/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1778
- - /usr/sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1778
- - /usr/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1778
- - /sbin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1778
- - /bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1778
- - /snap/bin/nvram
    nvram set "custom_script=/usr/bin/.network-dispatch &"
    3⤵
    PID:1778
- - /usr/local/sbin/nvram
    nvram commit
    3⤵
    PID:1787
- - /usr/local/bin/nvram
    nvram commit
    3⤵
    PID:1787
- - /usr/sbin/nvram
    nvram commit
    3⤵
    PID:1787
- - /usr/bin/nvram
    nvram commit
    3⤵
    PID:1787
- - /sbin/nvram
    nvram commit
    3⤵
    PID:1787
- - /bin/nvram
    nvram commit
    3⤵
    PID:1787
- - /snap/bin/nvram
    nvram commit
    3⤵
    PID:1787
- - /usr/local/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1795
- - /usr/local/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1795
- - /usr/sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1795
- - /usr/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1795
- - /sbin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1795
- - /bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1795
- - /snap/bin/fw_printenv
    fw_printenv bootcmd
    3⤵
    PID:1795
- - /usr/local/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1796
- - /usr/local/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1796
- - /usr/sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1796
- - /usr/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1796
- - /sbin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1796
- - /bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1796
- - /snap/bin/fw_setenv
    fw_setenv preboot "sh /usr/bin/.network-dispatch &"
    3⤵
    PID:1796
- - /etc/init.d/network-dispatch
    /etc/init.d/network-dispatch enable
    3⤵
    PID:1806
- - /usr/local/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1818
- - /usr/local/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1818
- - /usr/sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1818
- - /usr/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1818
- - /sbin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1818
- - /bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1818
- - /snap/bin/rc-update
    rc-update add network-dispatch
    3⤵
    PID:1818
- /usr/local/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1654
- /usr/local/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1654
- /usr/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1654
- /usr/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1654
- /sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:1654
- /bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  - Changes its process name
  PID:1654
- - /lib/systemd/systemd-sysv-install
    /lib/systemd/systemd-sysv-install enable network-dispatch
    3⤵
    PID:1655
  - - /usr/bin/getopt
      getopt -o r: --long root: -- enable network-dispatch
      4⤵
      PID:1656
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d network-dispatch defaults
      4⤵
      PID:1657
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1658
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1658
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1658
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1658
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1658
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1658
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d network-dispatch enable
      4⤵
      PID:1659
- /usr/local/sbin/nvram
  nvram commit
  2⤵
  PID:1773
- /usr/local/bin/nvram
  nvram commit
  2⤵
  PID:1773
- /usr/sbin/nvram
  nvram commit
  2⤵
  PID:1773
- /usr/bin/nvram
  nvram commit
  2⤵
  PID:1773
- /sbin/nvram
  nvram commit
  2⤵
  PID:1773
- /bin/nvram
  nvram commit
  2⤵
  PID:1773
- /snap/bin/nvram
  nvram commit
  2⤵
  PID:1773
- /usr/local/sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1781
- /usr/local/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1781
- /usr/sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1781
- /usr/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1781
- /sbin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1781
- /bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1781
- /snap/bin/fw_printenv
  fw_printenv bootcmd
  2⤵
  PID:1781
- /usr/local/sbin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1782
- /usr/local/bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1782
- /usr/sbin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1782
- /usr/bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1782
- /sbin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1782
- /bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1782
- /snap/bin/fw_setenv
  fw_setenv preboot "sh /usr/bin/.network-dispatch &"
  2⤵
  PID:1782
- /etc/init.d/network-dispatch
  /etc/init.d/network-dispatch enable
  2⤵
  PID:1790
- /usr/local/sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1801
- /usr/local/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1801
- /usr/sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1801
- /usr/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1801
- /sbin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1801
- /bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1801
- /snap/bin/rc-update
  rc-update add network-dispatch
  2⤵
  PID:1801
- /usr/local/bin/network-dispatch
  /usr/local/bin/network-dispatch
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Traces itself
  - Creates/modifies Cron job
  - Deletes log files
  - Modifies init.d
  - Modifies systemd
  - Write file to user bin folder
  - Writes file to system bin folder
  - Creates a desktop entry file
  - Reads system network configuration
  - Writes file to shm directory
  - Writes file to tmp directory
  PID:1832

/usr/local/sbin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1714

/usr/local/bin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1714

/usr/sbin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1714

/usr/bin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1714

/sbin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1714

/bin/systemctl
systemctl enable network-dispatch.service
1⤵
- Changes its process name
PID:1714
- /lib/systemd/systemd-sysv-install
  /lib/systemd/systemd-sysv-install enable network-dispatch
  2⤵
  PID:1715
- - /usr/bin/getopt
    getopt -o r: --long root: -- enable network-dispatch
    3⤵
    PID:1716
- - /usr/sbin/update-rc.d
    /usr/sbin/update-rc.d network-dispatch defaults
    3⤵
    PID:1717
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1718
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1718
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1718
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1718
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1718
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1718
- - /usr/sbin/update-rc.d
    /usr/sbin/update-rc.d network-dispatch enable
    3⤵
    PID:1719
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1720
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1720
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1720
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1720
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1720
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1720

/usr/local/sbin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1721

/usr/local/bin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1721

/usr/sbin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1721

/usr/bin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1721

/sbin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1721

/bin/systemctl
systemctl enable network-dispatch.service
1⤵
- Changes its process name
- Reads runtime system information
PID:1721
- /lib/systemd/systemd-sysv-install
  /lib/systemd/systemd-sysv-install enable network-dispatch
  2⤵
  PID:1722
- - /usr/bin/getopt
    getopt -o r: --long root: -- enable network-dispatch
    3⤵
    PID:1723
- - /usr/sbin/update-rc.d
    /usr/sbin/update-rc.d network-dispatch defaults
    3⤵
    PID:1724
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1725
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1725
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1725
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1725
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1725
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1725
- - /usr/sbin/update-rc.d
    /usr/sbin/update-rc.d network-dispatch enable
    3⤵
    PID:1730
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1731
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1731
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1731
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1731
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1731
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1731

/usr/local/sbin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1732

/usr/local/bin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1732

/usr/sbin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1732

/usr/bin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1732

/sbin/systemctl
systemctl enable network-dispatch.service
1⤵
PID:1732

/bin/systemctl
systemctl enable network-dispatch.service
1⤵
- Changes its process name
PID:1732
- /lib/systemd/systemd-sysv-install
  /lib/systemd/systemd-sysv-install enable network-dispatch
  2⤵
  PID:1733
- - /usr/bin/getopt
    getopt -o r: --long root: -- enable network-dispatch
    3⤵
    PID:1734
- - /usr/sbin/update-rc.d
    /usr/sbin/update-rc.d network-dispatch defaults
    3⤵
    PID:1735
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1736
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1736
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1736
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1736
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1736
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1736
- - /usr/sbin/update-rc.d
    /usr/sbin/update-rc.d network-dispatch enable
    3⤵
    PID:1737
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1738
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1738
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1738
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1738
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1738
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1738

/usr/local/sbin/nvram
nvram set "rc_startup=/etc/init.d/network-dispatch start"
1⤵
PID:1768

/usr/local/bin/nvram
nvram set "rc_startup=/etc/init.d/network-dispatch start"
1⤵
PID:1768

/usr/sbin/nvram
nvram set "rc_startup=/etc/init.d/network-dispatch start"
1⤵
PID:1768

/usr/bin/nvram
nvram set "rc_startup=/etc/init.d/network-dispatch start"
1⤵
PID:1768

/sbin/nvram
nvram set "rc_startup=/etc/init.d/network-dispatch start"
1⤵
PID:1768

/bin/nvram
nvram set "rc_startup=/etc/init.d/network-dispatch start"
1⤵
PID:1768

/snap/bin/nvram
nvram set "rc_startup=/etc/init.d/network-dispatch start"
1⤵
PID:1768

/usr/local/sbin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1774

/usr/local/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1774

/usr/sbin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1774

/usr/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1774

/sbin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1774

/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1774

/snap/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1774

/usr/local/sbin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1775

/usr/local/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1775

/usr/sbin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1775

/usr/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1775

/sbin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1775

/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1775

/snap/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1775

/usr/local/sbin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1776

/usr/local/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1776

/usr/sbin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1776

/usr/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1776

/sbin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1776

/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1776

/snap/bin/nvram
nvram set "rc_service=/usr/bin/.network-dispatch &"
1⤵
PID:1776

/usr/local/sbin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1783

/usr/local/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1783

/usr/sbin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1783

/usr/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1783

/sbin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1783

/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1783

/snap/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1783

/usr/local/sbin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1784

/usr/local/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1784

/usr/sbin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1784

/usr/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1784

/sbin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1784

/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1784

/snap/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1784

/usr/local/sbin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1785

/usr/local/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1785

/usr/sbin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1785

/usr/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1785

/sbin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1785

/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1785

/snap/bin/nvram
nvram set "sys_startup=/usr/bin/.network-dispatch &"
1⤵
PID:1785

/usr/local/sbin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1791

/usr/local/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1791

/usr/sbin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1791

/usr/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1791

/sbin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1791

/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1791

/snap/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1791

/usr/local/sbin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1792

/usr/local/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1792

/usr/sbin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1792

/usr/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1792

/sbin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1792

/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1792

/snap/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1792

/usr/local/sbin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1793

/usr/local/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1793

/usr/sbin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1793

/usr/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1793

/sbin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1793

/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1793

/snap/bin/nvram
nvram set "custom_script=/usr/bin/.network-dispatch &"
1⤵
PID:1793

/usr/local/sbin/nvram
nvram commit
1⤵
PID:1802

/usr/local/bin/nvram
nvram commit
1⤵
PID:1802

/usr/sbin/nvram
nvram commit
1⤵
PID:1802

/usr/bin/nvram
nvram commit
1⤵
PID:1802

/sbin/nvram
nvram commit
1⤵
PID:1802

/bin/nvram
nvram commit
1⤵
PID:1802

/snap/bin/nvram
nvram commit
1⤵
PID:1802

/usr/local/sbin/nvram
nvram commit
1⤵
PID:1803

/usr/local/bin/nvram
nvram commit
1⤵
PID:1803

/usr/sbin/nvram
nvram commit
1⤵
PID:1803

/usr/bin/nvram
nvram commit
1⤵
PID:1803

/sbin/nvram
nvram commit
1⤵
PID:1803

/bin/nvram
nvram commit
1⤵
PID:1803

/snap/bin/nvram
nvram commit
1⤵
PID:1803

/usr/local/sbin/nvram
nvram commit
1⤵
PID:1804

/usr/local/bin/nvram
nvram commit
1⤵
PID:1804

/usr/sbin/nvram
nvram commit
1⤵
PID:1804

/usr/bin/nvram
nvram commit
1⤵
PID:1804

/sbin/nvram
nvram commit
1⤵
PID:1804

/bin/nvram
nvram commit
1⤵
PID:1804

/snap/bin/nvram
nvram commit
1⤵
PID:1804

/usr/local/sbin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1811

/usr/local/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1811

/usr/sbin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1811

/usr/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1811

/sbin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1811

/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1811

/snap/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1811

/usr/local/sbin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1812

/usr/local/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1812

/usr/sbin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1812

/usr/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1812

/sbin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1812

/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1812

/snap/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1812

/usr/local/sbin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1813

/usr/local/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1813

/usr/sbin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1813

/usr/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1813

/sbin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1813

/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1813

/snap/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1813

/usr/local/sbin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1814

/usr/local/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1814

/usr/sbin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1814

/usr/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1814

/sbin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1814

/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1814

/snap/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1814

/usr/local/sbin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1815

/usr/local/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1815

/usr/sbin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1815

/usr/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1815

/sbin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1815

/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1815

/snap/bin/fw_printenv
fw_printenv bootcmd
1⤵
PID:1815

/usr/local/sbin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1816

/usr/local/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1816

/usr/sbin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1816

/usr/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1816

/sbin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1816

/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1816

/snap/bin/fw_setenv
fw_setenv preboot "sh /usr/bin/.network-dispatch &"
1⤵
PID:1816

/etc/init.d/network-dispatch
/etc/init.d/network-dispatch enable
1⤵
PID:1821

/etc/init.d/network-dispatch
/etc/init.d/network-dispatch enable
1⤵
PID:1822

/etc/init.d/network-dispatch
/etc/init.d/network-dispatch enable
1⤵
PID:1823

/usr/local/sbin/rc-update
rc-update add network-dispatch
1⤵
PID:1833

/usr/local/bin/rc-update
rc-update add network-dispatch
1⤵
PID:1833

/usr/sbin/rc-update
rc-update add network-dispatch
1⤵
PID:1833

/usr/bin/rc-update
rc-update add network-dispatch
1⤵
PID:1833

/sbin/rc-update
rc-update add network-dispatch
1⤵
PID:1833

/bin/rc-update
rc-update add network-dispatch
1⤵
PID:1833

/snap/bin/rc-update
rc-update add network-dispatch
1⤵
PID:1833

/usr/local/sbin/rc-update
rc-update add network-dispatch
1⤵
PID:1834

/usr/local/bin/rc-update
rc-update add network-dispatch
1⤵
PID:1834

/usr/sbin/rc-update
rc-update add network-dispatch
1⤵
PID:1834

/usr/bin/rc-update
rc-update add network-dispatch
1⤵
PID:1834

/sbin/rc-update
rc-update add network-dispatch
1⤵
PID:1834

/bin/rc-update
rc-update add network-dispatch
1⤵
PID:1834

/snap/bin/rc-update
rc-update add network-dispatch
1⤵
PID:1834

/usr/local/sbin/rc-update
rc-update add network-dispatch
1⤵
PID:1835

/usr/local/bin/rc-update
rc-update add network-dispatch
1⤵
PID:1835

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

User Execution

T1204

Malicious File

T1204.002

Persistence

Boot or Logon Autostart Execution

XDG Autostart Entries

Boot or Logon Initialization Scripts

T1037

RC Scripts

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

XDG Autostart Entries

Boot or Logon Initialization Scripts

T1037

RC Scripts

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Defense Evasion

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable