1.pre_infection_git_status

git status
On branch master
Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git checkout -- <file>..." to discard changes in working directory)
  (commit or discard the untracked or modified content in submodules)

	modified:   proc/self
	modified:   proc/thread-self
	modified:   run/log/journal/195a303ea1c8760dc28e54315b1c54bb/system.journal
	modified:   usr/local/rvm/gems/ruby-2.5.1/bundler/gems/php-serialize-31dde871262f (modified content)
	modified:   var/log/salt/minion
	modified:   var/log/syslog

2._post_infection_git_status

git status
On branch master
Changes not staged for commit:
  (use "git add/rm <file>..." to update what will be committed)
  (use "git checkout -- <file>..." to discard changes in working directory)
  (commit or discard the untracked or modified content in submodules)

	deleted:    etc/apparmor.d/cache/.features
	deleted:    etc/apparmor.d/cache/lxc-containers
	deleted:    etc/apparmor.d/cache/sbin.dhclient
	deleted:    etc/apparmor.d/cache/usr.bin.lxc-start
	deleted:    etc/apparmor.d/cache/usr.lib.lxd.lxd-bridge-proxy
	deleted:    etc/apparmor.d/cache/usr.lib.snapd.snap-confine.real
	deleted:    etc/apparmor.d/cache/usr.sbin.mysqld
	deleted:    etc/apparmor.d/cache/usr.sbin.ntpd
	deleted:    etc/apparmor.d/cache/usr.sbin.tcpdump
	modified:   etc/init.d/.depend.boot
	modified:   etc/init.d/.depend.start
	modified:   etc/init.d/.depend.stop
	deleted:    etc/rcS.d/S02apparmor
	modified:   etc/selinux/config
	modified:   etc/sysctl.conf
	modified:   proc/self
	modified:   proc/thread-self
	modified:   root/.viminfo
	modified:   root/.wget-hsts
	modified:   run/acpid.pid
	deleted:    run/irqbalance.pid
	modified:   run/log/journal/195a303ea1c8760dc28e54315b1c54bb/system.journal
	modified:   run/systemd/generator.late/apparmor.service
	deleted:    run/systemd/generator.late/sysinit.target.wants/apparmor.service
	modified:   usr/local/rvm/gems/ruby-2.5.1/bundler/gems/php-serialize-31dde871262f (modified content)
	modified:   var/lib/ntp/ntp.drift
	modified:   var/log/audit/audit.log
	modified:   var/log/auth.log
	modified:   var/log/kern.log
	modified:   var/log/salt/minion
	deleted:    var/log/syslog
	modified:   var/spool/cron/crontabs/root

Untracked files:
  (use "git add <file>..." to include in what will be committed)

	dev/char/202:0
	dev/char/202:1
	dev/char/202:2
	dev/char/202:3
	dev/char/202:4
	dev/char/202:5
	dev/char/202:6
	dev/char/202:7
	etc/init/apparmor.override
	etc/rcS.d/K02apparmor
	root/sa.sh
	run/lock/linux.lock
	run/log/journal/195a303ea1c8760dc28e54315b1c54bb/system@9e461b4280b54a1d95246e5434c856ba-0000000000000001-0005a4c9ead3f73f.journal
	run/log/journal/195a303ea1c8760dc28e54315b1c54bb/system@9e461b4280b54a1d95246e5434c856ba-0000000000000ed7-0005a4cac2d08abf.journal
	run/udev/data/+class:msr
	run/udev/data/+module:ip6_tables
	run/udev/data/+module:ip6table_filter
	run/udev/data/+module:ip_tables
	run/udev/data/+module:iptable_filter
	run/udev/data/+module:msr
	run/udev/data/+module:x_tables
	run/udev/data/c202:0
	run/udev/data/c202:1
	run/udev/data/c202:2
	run/udev/data/c202:3
	run/udev/data/c202:4
	run/udev/data/c202:5
	run/udev/data/c202:6
	run/udev/data/c202:7
	run/xtables.lock
	tmp/.ICEd-unix/
	tmp/salt-minions
	var/tmp/salt-store