mkdir-p/etc/X11/applnk/internet/ etc

what is the attacker ultimately trying to achieve as inferred from the log sequence?